CVE-2024-48032: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in sumitsurai Featured Posts with Multiple Custom Groups FPMCG featured-posts-with-multiple-custom-groups-fpmcg allows Reflected XSS.This issue affects Featured Posts with Multiple Custom Groups FPMCG...

Malware in ava-ilable-down-load-mp3-today-50529-lets-change-the-world-with-music-cx2zi-xhskuv

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-9337 Malicious code in ava-ilable-down-load-mp3-today-50529-lets-change-the-world-with-music-cx2zi-xhskuv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df195ac8737511909f9fe9908cbb3c0cc9287f38837903e901667ca3ac686141 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9408 Malicious code in j5gerggnpuiwerbngpiutbgn0iutb0p (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3b948e846f1817c6c72336ef38aac1149d25e0e40dc903eef60f7af4f3625e1f According to the description, packages should demonstrate the dependency confusion attack. The realisation is, in fact, a spamming with packages having as the...

MAL-2024-9305 Malicious code in ts-calling-test-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0db756d26a3007b10201297415dfaa2cf6315b37f9ef0b88fa32feac6aaf42bd The OpenSSF Package Analysis project identified 'ts-calling-test-app' @ 1.999.0 npm as malicious. It is considered malicious because: - The...

CVE-2024-49242: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in Shafiq Digital Lottery digital-lottery allows Upload a Web Shell to a Web Server.This issue affects Digital Lottery: from n/a through = 3.0.5...

CVE-2024-9687: Authorization Bypass Through User-Controlled Key

The WP 2FA with Telegram plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0. This is due to insufficient validation of the user-controlled key on the 'validatetg' action. This makes it possible for authenticated attackers, with subscriber-level...

CVE-2024-9820: Reliance on Cookies without Validation and Integrity Checking in a Security Decision

The WP 2FA with Telegram plugin for WordPress is vulnerable to Two-Factor Authentication Bypass in versions up to, and including, 3.0. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass two-factor authentication...

PT-2024-39865

Name of the Vulnerable Software and Affected Versions WP 2FA with Telegram plugin for WordPress versions up to, and including, 3.0 Description The issue is related to Two-Factor Authentication Bypass. This is due to the two-factor code being stored in a cookie, which makes it possible to bypass...

MAL-2024-9281 Malicious code in test-automation-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f06e180b42b483251e9be9757c11456faac61b034b2b3c0cb72e20162987c156 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-9821

CVE-2024-9821 : The WordPress plugin “Bot for Telegram on WooCommerce” is vulnerable to sensitive information disclosure due to missing authorization checks on the stm_wpcfto_get_settings AJAX action, affecting all versions up to 1.2.4. Authenticated attackers with subscriber-level access and abo...

CVE-2024-9821 Bot for Telegram on WooCommerce <= 1.2.7 - Authenticated (Subscriber+) Telegram Bot Token Disclosure to Authentication Bypass

The Bot for Telegram on WooCommerce plugin for WordPress is vulnerable to sensitive information disclosure due to missing authorization checks on the 'stmwpcftogetsettings' AJAX action in all versions up to, and including, 1.2.7. This makes it possible for authenticated attackers, with...

PT-2024-39391

Name of the Vulnerable Software and Affected Versions WP Ultimate Post Grid plugin for WordPress versions up to and including 3.9.3 Description The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the wpupg-grid-with-filters shortcode. This allo...

CVE-2024-9051: Improper Neutralization of Input During Web Page Generation

The WP Ultimate Post Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wpupg-grid-with-filters shortcode in all versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

chat-with-mlx (>=0.1.0, <=0.1.5), megatts (3.0.0) potentially affected by CVE-2024-47872 via gradio (4.19.1)

gradio PYPI version 4.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chat-with-mlx =0.1.0, =0.1.5 - megatts 3.0.0 Source cves: CVE-2024-47872 Source advisory: OSV:PYSEC-2024-220...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2024-47871 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2024-47871 Source advisory: OSV:PYSEC-2024-219...

askdoc (0.1.1), chat-with-mlx (>=0.1.6, <=0.1.11) +1 more potentially affected by CVE-2024-47870 via gradio (4.19.2)

gradio PYPI version 4.19.2 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - askdoc 0.1.1 - chat-with-mlx =0.1.6, =0.1.11 - hugegraph-llm 1.3.0 Source cves: CVE-2024-47870 Source advisory: OSV:PYSEC-2024-218...

chat-with-mlx (>=0.1.0, <=0.1.5), megatts (3.0.0) potentially affected by CVE-2024-47871 via gradio (4.19.1)

gradio PYPI version 4.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chat-with-mlx =0.1.0, =0.1.5 - megatts 3.0.0 Source cves: CVE-2024-47871 Source advisory: OSV:PYSEC-2024-219...

chat-with-mlx (>=0.1.0, <=0.1.5), megatts (3.0.0) potentially affected by CVE-2024-47870 via gradio (4.19.1)

gradio PYPI version 4.19.1 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - chat-with-mlx =0.1.0, =0.1.5 - megatts 3.0.0 Source cves: CVE-2024-47870 Source advisory: OSV:PYSEC-2024-218...

autobiasdetector (0.0.2), chat-with-mlx (>=0.2.0, <=0.2.2) +6 more potentially affected by CVE-2024-47868 via gradio (4.29.0)

gradio PYPI version 4.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - autobiasdetector 0.0.2 - chat-with-mlx =0.2.0, =0.1.1, =0.0.1, =0.0.1, =1.3.0, =1.4.3 Source cves: CVE-2024-47868 Source advisory: OSV:PYSEC-2024-2...