Malicious code in rc-postmessage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3efaf8ce2d77ed7f18f8738560aeafd7abb05ba0520d5498241baca769bdbaab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5604 Malicious code in rc-postmessage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3efaf8ce2d77ed7f18f8738560aeafd7abb05ba0520d5498241baca769bdbaab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rc-qna-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1af95347190cb80ff6def6e7f12e037250c25d2d9d3b86b202747825483a14f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5605 Malicious code in rc-qna-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1af95347190cb80ff6def6e7f12e037250c25d2d9d3b86b202747825483a14f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yarn-design-system-rc-input-number (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af670dcb9945b741b8a4b4a71a54c4da8d08032685b0db16fdfbe7847bd66d0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Code injection

A vulnerability was found in Elefant CMS 1.3.12-RC. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /designer/add/layout. The manipulation leads to code injection. The attack can be launched remotely. Upgrading to version 1.3.13 is able to...

CVE-2017-20062

CVE-2017-20062 affects Elefant CMS 1.3.12-RC. The issue is a cross-site request forgery (CSRF) vulnerability that can be manipulated remotely; exploit has been disclosed publicly. Upgrading to version 1.3.13 mitigates the issue. Multiple connected sources (RH, NVD, OSV, CNVD, CNVD/Vuln enrichment...

Elefant CMS 跨站脚本漏洞

Elefant CMS is a simple PHP content management system and web framework by Canadian John de Plume, an individual developer. A security vulnerability exists in Elefant CMS version 1.3.12-RC, which can be exploited by attackers to perform cross-site scripting attacks...

CVE-2017-20060: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

A vulnerability, which was classified as problematic, was found in Elefant CMS 1.3.12-RC. This affects an unknown part of the component Blog Post Handler. The manipulation leads to basic cross site scripting Persistent. It is possible to initiate the attack remotely. Upgrading to version 1.3.13 i...

Elefant CMS 代码问题漏洞

Elefant CMS is a simple PHP content management system and web framework by Canadian John de Plume, an individual developer. A security vulnerability exists in Elefant CMS version 1.3.12-RC, which stems from unknown functionality in file/filemanager/upload/drop for component file uploads. A remote...

CVE-2017-20062: Cross-Site Request Forgery (CSRF)

A vulnerability was found in Elefant CMS 1.3.12-RC and classified as problematic. This issue affects some unknown processing. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to...

Malicious code in rc-trigger-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a44ac84dbb210499c522f00f5bc12e0dc1c615d3d453d501bece9dc71ac8273 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5606 Malicious code in rc-trigger-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2a44ac84dbb210499c522f00f5bc12e0dc1c615d3d453d501bece9dc71ac8273 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-29695

Unicorn Engine v2.0.0-rc7 contains memory leaks caused by an incomplete unicorn engine initialization...

CVE-2022-29235

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker who is able to obtain the meeting identifier for a meeting on a server can find information related to an external video being shared, like the current timestamp...

CVE-2022-29236

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced gra...

CVE-2022-29236 Improper access control for pencil annotations in BigBlueButton

BigBlueButton is an open source web conferencing system. Starting in version 2.2 and prior to versions 2.3.18 and 2.4-rc-6, an attacker can circumvent access restrictions for drawing on the whiteboard. The permission check is inadvertently skipped on the server, due to a previously introduced gra...

CVE-2022-29233 Improper access control for breakout rooms in BigBlue Button

BigBlueButton is an open source web conferencing system. In BigBlueButton starting with 2.2 but before 2.3.18 and 2.4-rc-1, an attacker can circumvent access controls to gain access to all breakout rooms of the meeting they are in. The permission checks rely on knowledge of internal ids rather th...

Cross-site Scripting in wiki manager join wiki page

Impact We found a possible XSS vector in the WikiManager.JoinWiki wiki page related to the "requestJoin" field. Patches The issue is patched in versions 12.10.11, 14.0-rc-1, 13.4.7, 13.10.3. Workarounds The easiest workaround is to edit the wiki page WikiManager.JoinWiki with wiki editor and chan...

Cross site scripting

XWiki Platform Flamingo Theme UI is a tool that allows customization and preview of any Flamingo-based skin. Starting with versions 6.2.4 and 6.3-rc-1, a possible cross-site scripting vector is present in the FlamingoThemesCode.WebHomeSheet wiki page related to the "newThemeName" form field. The...