Malicious code in jqtools-toolbox-expose (npm)

The package contains code to exfiltrate user and host information to an oastify domain. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf8ecc5384976555e101e147d0456707c86467e52647ed0bdbc91bc47639356a The OpenSSF Package Analysis project identified...

MAL-2024-7784 Malicious code in jqtools-toolbox-expose (npm)

The package contains code to exfiltrate user and host information to an oastify domain. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cf8ecc5384976555e101e147d0456707c86467e52647ed0bdbc91bc47639356a The OpenSSF Package Analysis project identified...

Malicious code in toolbox-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 08eb63c88d757784c7886fd9e365d836ff111c5c27741eef78fed201a5e485e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Important: Red Hat Security Advisory: toolbox security update

An update for toolbox is now available for Red Hat Enterprise Linux 9.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

RHEL 9 : toolbox (RHSA-2024:4443)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2024:4443 advisory. Toolbox is a tool for Linux operating systems, which allows the use of containerized command line environments. It is built on top of Podman and othe...

Malicious code in wmi-toolbox (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6214 Malicious code in wmi-toolbox (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in stitch-ui-toolbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8c164c3cf7998ef763616f524ca40c36a007e570d7c43c1ee9bff41689d29cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-3055 Malicious code in stitch-ui-toolbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8c164c3cf7998ef763616f524ca40c36a007e570d7c43c1ee9bff41689d29cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-3134 Malicious code in toolbox-pkg-components (npm)

False positive caused by problematic ingestion. --- -= Per source details. Do not edit below this line.=-...

libxml2 security update

An update is available for libxml2. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The libxml2 library is a development toolbox providing the implementation of...

ShellSweep - PowerShell/Python/Lua Tool Designed To Detect Potential Webshell Files In A Specified Directory

ShellSweep ShellSweeping the evil Why ShellSweep "ShellSweep" is a PowerShell/Python/Lua tool designed to detect potential webshell files in a specified directory. ShellSheep and it's suite of tools calculate the entropy of file contents to estimate the likelihood of a file being a webshell. High...

CVE-2024-4473

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-4473

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-4473 Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

CVE-2024-4473

CVE-2024-4473 affects the Sydney Toolbox plugin for WordPress, where the Sydney Toolbox's aThemes: Portfolio widget (

CVE-2024-4473 Sydney Toolbox <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget

The Sydney Toolbox plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the "aThemes: Portfolio" widget in all versions up to, and including, 1.31 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

WordPress Sydney Toolbox plugin <= 1.31 - Authenticated (Contributor+) Stored Cross-Site Scripting via aThemes: Portfolio Widget vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via aThemes: Portfolio Widget vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Sydney Toolbox versions = 1.31...

PT-2024-31227 · WordPress · Sydney Toolbox

Name of the Vulnerable Software and Affected Versions: Sydney Toolbox plugin for WordPress versions up to, and including, 1.31 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the "aThemes: Portfolio" widget, allowing...

WordPress Sydney Toolbox Plugin <= 1.31 is vulnerable to Cross Site Scripting (XSS)

Software Sydney Toolbox Type Plugin Vulnerable versions = 1.31 Fixed in 1.32 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4473 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID f1fd3834832c Credits Ngô Thiên An ancorn Require...