11807 matches found
MAL-2022-7063 Malicious code in weather-power-up (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a4fa4b856ba13413f1fa2757b592c0b5988dd18bd051989b3ca22ee0f975fc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in weather-power-up (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a4fa4b856ba13413f1fa2757b592c0b5988dd18bd051989b3ca22ee0f975fc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Cross-site Scripting (XSS) - Stored
Description Titra is vulnerable to Stored XSS in the Task field when creating a new task in a project. Steps to reproduce 1.In the Overview tab, click on New project button. 2.Enter a project name and click Save. 3.Move to the Tasks tab in that project and click on New Task button. 4.In the Task...
Cross site request forgery (csrf)
The New User Email Set Up WordPress plugin through 0.5.2 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...
CVE-2022-1790
The CVE-2022-1790 entry concerns the WordPress plugin “New User Email Set Up” (versions
PT-2022-14083
Name of the Vulnerable Software and Affected Versions WPMK Ajax Finder WordPress plugin versions up to and including 1.0.1 Description The issue is related to Cross-Site Request Forgery, which occurs due to a missing nonce check in the createplugin atf admin setting page function found in the...
CVE-2021-41754
dynamicMarkt = 3.10 is affected by SQL injection in the parent parameter of index.php...
PT-2022-8292 · Wolfcms · Wolf Cms
Name of the Vulnerable Software and Affected Versions: WolfCMS versions up to 0.8.3.1 Description: A vulnerability was found in WolfCMS that affects the processing of the file /wolfcms/?/admin/user/add of the component User Add. The manipulation of the name argument leads to basic cross site...
CVE-2022-29453
Cross-Site Request Forgery CSRF vulnerability in API KEY for Google Maps plugin = 1.2.1 at WordPress leading to Google Maps API key update...
HUAWEI HarmonyOS has an unspecified vulnerability (CNVD-2022-66176)
HUAWEI HarmonyOS is an operating system from Huawei China. It provides a microkernel-based distributed operating system. A security vulnerability exists in HUAWEI HarmonyOS 2.0, which stems from a post-lock pop-up box issue in the operator's custom USSD service, and could be exploited by an...
Bypass filter - Stored XSS in Resources
Description Website does incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Proof of concept javaSCRIPTalertorigin Steps to reproduce it works on Firefox not in chromium based browsers 1.Go to...
PT-2022-20474
Name of the Vulnerable Software and Affected Versions PJSIP versions prior to and including 2.12.1 Description PJSIP is a free and open source multimedia communication library written in C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. A stack buffer...
HUAWEI HarmonyOS 安全漏洞
HUAWEI HarmonyOS is an operating system from Huawei China. It provides a microkernel-based distributed operating system. A security vulnerability exists in HUAWEI HarmonyOS 2.0, which stems from a post-lock pop-up box issue in the operator's custom USSD service, and could be exploited by an...
Stored XSS in Resources
Description Website does incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. Steps to reproduce it works on Firefox not in chromium based browsers 1.Go to https://www.rosariosis.org/demonstration/ and login with...
Ascensio System ONLYOFFICE Document Server 缓冲区错误漏洞
Ascensio System ONLYOFFICE Document Server is an online office collaboration suite from Ascensio System, Latvia. The product supports viewing and editing of text, spreadsheets, presentations and more. A security vulnerability exists in Ascensio System ONLYOFFICE Document Server version v6.0.0 and...
CVE-2021-27781
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie...
Code injection
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie...
CVE-2021-27781 HCL BigFix Mobile / Modern Client Management is vulnerable to stored cross-site scripting
The Master operator may be able to embed script tag in HTML with alert pop-up display cookie...
CVE-2021-27781
CVE-2021-27781 affects HCL Technologies BigFix Mobile/Modern Client Management (1.x and 2.0). The issue is a stored cross-site scripting vulnerability that allows embedding a script tag in HTML to trigger an alert pop-up displaying a cookie. Descriptions across multiple sources label this as a st...