CVE-2024-6661: Improper Neutralization of Input During Web Page Generation

The ParityPress – Parity Pricing with Discount Rules plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'Discount Text' in all versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wi...

A (somewhat) complete timeline of Talos’ history

A lot has happened in Talos 10 years of existence. And to celebrate our birthday, we wanted to look back on some of the major moments in Talos history. Heres an overview of some of the major events, cyber attacks, research breakthroughs and more that truly make Talos Talos. We hope this walk down...

CVE-2024-37429

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Hamid Alinia – idehweb Login with phone number allows Stored XSS.This issue affects Login with phone number: from n/a through 1.7.35...

CVE-2024-37429 WordPress Login with phone number plugin <= 1.7.35 - Admin+ Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Hamid Alinia – idehweb Login with phone number allows Stored XSS.This issue affects Login with phone number: from n/a through 1.7.35...

CVE-2024-38708: Improper Neutralization of Special Elements used in an SQL Command

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Dmitry V. CEO of "UKR Solution" Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory &...

CVE-2024-6913: Execution with Unnecessary Privileges

Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0...

CVE-2024-37429: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through = 1.7.35...

Adobe: Disclosure of git metadata and springboot actuator information

The vulnerability involved the disclosure of git metadata and Springboot actuator information, which was responsibly disclosed and addressed through collaboration with the hacker...

CVE-2024-21184: Execution with Unnecessary Privileges

Vulnerability in the Oracle Database RDBMS Security component of Oracle Database Server. Supported versions that are affected are 19.3-19.23. Easily exploitable vulnerability allows high privileged attacker having Execute on SYS.XSDIAG privilege with network access via Oracle Net to compromise...

CVE-2024-40393: Improper Neutralization of Special Elements used in an SQL Command

Online Clinic Management System In PHP With Free Source code v1.0 was discovered to contain a SQL injection vulnerability via the user parameter at login.php...

CVE-2024-2691: Improper Neutralization of Input During Web Page Generation

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'events' shortcode in all versions up to, and including, 3.1.43 due to insufficient input sanitization and output escaping on use...

CVE-2024-6559: Exposure of Sensitive Information to an Unauthorized Actor

The Backup, Restore and Migrate WordPress Sites With the XCloner Plugin plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 4.7.3. This is due the plugin utilizing sabre without preventing direct access to the files. This makes it possible for...

MAL-2024-7737 Malicious code in lykooss_poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ba3a00276cdb801eafba21620fd8bb30298090ac3c341a63455934994d7c6bb The OpenSSF Package Analysis project identified 'lykoosspoc' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-38734: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type vulnerability in SpreadsheetConverter Import Spreadsheets from Microsoft Excel allows Code Injection.This issue affects Import Spreadsheets from Microsoft Excel: from n/a through 10.1.4...

MAL-2024-7670 Malicious code in sap-catorder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a4d0a65fe6fa8befaf90ff6e8553923a6f0018202e771c06fbabca90482ce306 The OpenSSF Package Analysis project identified 'sap-catorder' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7644 Malicious code in sap-authitem (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f6bddbe556bea51802eadeaf835c5a115dc0c681418d7a5a3fce19689b32aa2a The OpenSSF Package Analysis project identified 'sap-authitem' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7645 Malicious code in sap-badfiles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4a9459e9f1bcf3b7c028ace7fe4af0c22616ec0e041f4f784c04288e1e3d4c79 The OpenSSF Package Analysis project identified 'sap-badfiles' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7673 Malicious code in sap-cd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b129ce991640a28395649d0743d86a38416052a617e290ac3fbe220ab780351c The OpenSSF Package Analysis project identified 'sap-cd' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicate...

MAL-2024-7605 Malicious code in sap-banreason (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1fa7dc864beb53e0fc53f649c195a692e7c3702aeeff1938fc8e427c33ba5e2d The OpenSSF Package Analysis project identified 'sap-banreason' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sap-assign (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3e112087f561ca61a642cf1a40c5cc1e7dbed013d9b068897a47af54b8b6c653 The OpenSSF Package Analysis project identified 'sap-assign' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...