Malicious code in tricks_updated_xbox_unlimited_giftcards__generator_for_free-rpk9 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in tricks_unlimited_fa_ke_bit_coin_trans_action_generator_freee_unlimited_y6u6 (npm)

--- -= Per source details. Do not edit below this line.=-...

Improper Authentication

github.com/pocketbase/pocketbase is vulnerable to Improper Authentication. The vulnerability is due to unverified account linking because an attacker can create an unverified account with the targeted user's email, and when the user signs up with OAuth2, their account is linked without changing t...

PocketBase performs password auth and OAuth2 unverified email linking

In order to be exploited you must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: - a malicious actor register with the targeted user's email it is unverified - at some later point in time the targeted user stumble on your app and decides to sign-up with...

CVE-2024-38351 Password auth and OAuth2 unverified email linking

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

CVE-2024-38351 Password auth and OAuth2 unverified email linking

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

CVE-2024-38351 Password auth and OAuth2 unverified email linking

Pocketbase is an open source web backend written in go. In affected versions a malicious user may be able to compromise other user accounts. In order to be exploited users must have both OAuth2 and Password auth methods enabled. A possible attack scenario could be: 1. a malicious actor register...

PocketBase Security Vulnerability

PocketBase is an open source real-time backend for PocketBase Open Source. A security vulnerability exists in Pocketbase versions prior to 0.22.14, which stems from password validation and OAuth2 unverified email links...

BIT-SUITECRM-2024-36417 SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame

SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue...

CVE-2024-36417

SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue...

CVE-2024-36417

SuiteCRM has a stored XSS vulnerability (CVE-2024-36417) where an unverified IFrame injected via input can be used for cross-site scripting and potentially code execution. Affected versions are prior to 7.14.4 and 8.6.1; these releases fix the issue. Remediation: upgrade to 7.14.4 or 8.6.1 (or la...

CVE-2024-36417 SuiteCRM Stored XSS Vulnerability Allows Code Execution via Malicious iFrame

SuiteCRM is an open-source Customer Relationship Management CRM software application. Prior to versions 7.14.4 and 8.6.1, an unverified IFrame can be added some some inputs, which could allow for a cross-site scripting attack. Versions 7.14.4 and 8.6.1 contain a fix for this issue...

The vulnerability of the software for calculating the positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager lies in the loading of code without checking its integrity. This allows a perpetrator to execute arbitrary code.

The vulnerability of the software for calculating the positions of individual RTLS transponders in the SIMATIC RTLS Locating Manager lies in the loading of code without checking its integrity. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...

scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication...

GHSA-H6MP-MC7G-MG49 scheb/two-factor-bundle bypass two-factor authentication with unverified JWT trusted device token

Before version 3.7 the bundle is vulnerable to a security issue in JWT, which can be exploited by an attacker to generate trusted device cookies on their own, effectively by-passing two-factor authentication...

GitLab 12.2 < 12.9.8 / 12.10 < 12.10.7 / 13.0 < 13.0.1 (CVE-2020-13275)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - A user with an unverified email address could request an access to domain restricted groups in GitLab EE 12.2 and later through 13.0.1 CVE-2020-13275 Note that Nessus has not tested for this issue but...

GitLab 12.3 < 12.9.8 / 12.10 < 12.10.7 / 13.0 < 13.0.1 (CVE-2020-13272)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - OAuth flow missing verification checks CE/EE 12.3 and later through 13.0.1 allows unverified user to use OAuth authorization code flow CVE-2020-13272 Note that Nessus has not tested for this issue but...

The vulnerability of the engineer mode of Unisoc microprogrammed software chips, which allows a hacker to trigger a service failure.

The vulnerability of the engineer mode of Unisoc microprogrammed chipset software is related to unverified array indexing. Exploiting this vulnerability can allow attackers to cause service failures...

Qualcomm Chipsets 安全漏洞

Qualcomm Chipsets are a family of chipsets from Qualcomm Incorporated USA. A security vulnerability exists in Qualcomm Chipsets that originates from a memory corruption that occurs when a user passes a channel ID that is not verified and further used...

CVE-2024-32018

RIOT is a real-time multi-threading operating system that supports a range of devices that are typically 8-bit, 16-bit and 32-bit microcontrollers. Most codebases define assertion macros which compile to a no-op on non-debug builds. If assertions are the only line of defense against untrusted...