Malware in gatsby-starter-gitlab

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-8431 Malicious code in gatsby-starter-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bc23995a775ff33fc2732574cfd95b0d8efee1cdcadd229b67acde3123fac5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gatsby-starter-gitlab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9bc23995a775ff33fc2732574cfd95b0d8efee1cdcadd229b67acde3123fac5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

top.tangyh.basic:lamp-all (>=3.5.3, <=3.7.0), top.tangyh.basic:lamp-boot-util (>=3.5.3, <=3.7.0) +12 more potentially affected by CVE-2023-31579 via top.tangyh.basic:lamp-core (>=3.4.0, <=3.7.0)

top.tangyh.basic:lamp-core MAVEN version =3.4.0, =3.5.3, =3.5.3, =3.4.0, =3.4.0, =3.5.3, =3.4.0, =3.4.0, =3.4.0, =3.4.0, =3.4.0, =3.7.0 - top.tangyh.basic:lamp-xss-starter 3.7.0 Source cves: CVE-2023-31579 Source advisory: MEND:CVE-2023-31579...

cc.vihackerframework:vihacker-web-starter (1.0.8.r), cloud.piranha.http:piranha-http-undertow (>=22.11.0, <=23.4.0) +345 more potentially affected by CVE-2023-1108 via io.undertow:undertow-core (>=2.3.0.final, <=2.3.4.final)

io.undertow:undertow-core MAVEN version =2.3.0.final, =22.11.0, =22.11.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.1.0, =3.0.4.1, =3.0.1.0, =3.0.1.0, =4.0.0-draft.2, =4.0.0-draft.2, =22.10.1, =22.10.1, =23.2.1 and more Source cves: CVE-2023-1108 Source advisory: OSV:GHSA-M4MM-PG93-FV78...

cn.hutool:hutool-dfa (4.5.15), cn.hutool:hutool-http (4.5.15) +5 more potentially affected by CVE-2023-42276 via cn.hutool:hutool-json (4.5.15)

cn.hutool:hutool-json MAVEN version 4.5.15 is affected by a known vulnerability. The following packages have a transitive dependency on cn.hutool:hutool-json and may be impacted: - cn.hutool:hutool-dfa 4.5.15 - cn.hutool:hutool-http 4.5.15 - cn.virens:virens-oauth2 1.3.8 - cn.virens:virens-util...

WordPress Premium Starter Templates Plugin <= 3.2.5 is vulnerable to Broken Access Control

Software Premium Starter Templates Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.2.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-41805 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 39ca3635507b Credits Rafie Muhammad...

WordPress Premium Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF)

Software Premium Starter Templates Type Plugin Vulnerable versions = 3.2.4 Fixed in 3.2.5 OWASP Top 10 A5: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-41804 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 95875b60baf4 Credits Rafie...

WordPress Starter Templates Plugin <= 3.2.5 is vulnerable to Broken Access Control

Software Starter Templates Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.2.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-41805 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 34baa5c0cfc1 Credits Rafie Muhammad Patchstack...

WordPress Starter Templates Plugin <= 3.2.4 is vulnerable to Server Side Request Forgery (SSRF)

Software Starter Templates Type Plugin Vulnerable versions = 3.2.4 Fixed in 3.2.5 OWASP Top 10 A5: Broken Access Control Classification Server Side Request Forgery SSRF CVE CVE-2023-41804 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 9a3308ad9975 Credits Rafie Muhammad...

Security Bulletin: z/Transaction Processing Facility is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]

Summary The Python Cryptographic Authority package is used by the z/TPF real-time insights dashboard starter kit when connecting to a MySQL database from Python. The starter kit was updated to address the vulnerability described by CVE-2023-38325. Vulnerability Details CVEID:CVE-2023-38325...

com.github.vindell:spring-boot-starter-pf4j2 (>=1.0.0.release, <=1.0.1.release), org.pf4j:pf4j-update (>=2.0.0, <=2.1.0) potentially affected by CVE-2023-40828 via org.pf4j:pf4j (2.2.0)

org.pf4j:pf4j MAVEN version 2.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.pf4j:pf4j and may be impacted: - com.github.vindell:spring-boot-starter-pf4j2 =1.0.0.release, =2.0.0, =2.1.0 Source cves: CVE-2023-40828 Source advisory:...

Malware in infocaster-frontend-bootstrap-4-starter

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2023-1058 Malicious code in infocaster-frontend-bootstrap-4-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c55745943f07b53663bfc73b3b50663ca02b9b94e8897b082272ea0be460c533 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

cloud.opencode.base:opencode-base-token (1.0.0), io.github.junxworks:junx-ep-auth (>=2.0.0, <=2.1.0) +11 more potentially affected by CVE-2023-34478 via org.apache.shiro:shiro-web (>=2.0.0-alpha-1, <=2.0.0-alpha-2)

org.apache.shiro:shiro-web MAVEN version =2.0.0-alpha-1, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-1, =2.0.0-alpha-2 Source cves: CVE-2023-34478 Source advisory: MEND:CVE-2023-34478...

WordPress Spice Starter Sites Plugin < 1.1 is vulnerable to Cross Site Scripting (XSS)

Software Spice Starter Sites Type Plugin Vulnerable versions 1.1 Fixed in 1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9401fa99b65e Credits Rafie Muhammad Patchstack Required...

WordPress WordPress Everse Starter Sites – Elementor Templates Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)

Software WordPress Everse Starter Sites – Elementor Templates Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8f53de574344 Credi...

WordPress GloriousThemes Starter Sites Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)

Software GloriousThemes Starter Sites Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID fbb0bb613259 Credits Rafie Muhammad...

Malicious code in js-starter-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac64c737affe45fd76d9899026d4a4d2f775e04e0391693ffcb2dafa665b07c5 The OpenSSF Package Analysis project identified 'js-starter-code' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1220 Malicious code in js-starter-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac64c737affe45fd76d9899026d4a4d2f775e04e0391693ffcb2dafa665b07c5 The OpenSSF Package Analysis project identified 'js-starter-code' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...