CVE-2024-37870: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in processscore.php in Learning Management System Project In PHP With Source Code 1.0 allows attackers to execute arbitrary SQL commands via the id parameter...

This Week in Spring - July 9th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it's been! We've got a lot to get into, so let's dive right in. I quite liked this talk, Continuations: The magic behind virtual threads in Java by Balkrishna Rawool @ Spring I/O 2024 In last week's episode of...

CVE-2024-4944: Improper Neutralization of Special Elements used in a Command

A local privilege escalation vlnerability in the WatchGuard Mobile VPN with SSL client on Windows enables a local user to execute arbitrary commands with elevated privileged...

CVE-2024-6614: Loop with Unreachable Exit Condition

The frame iterator could get stuck in a loop when encountering certain wasm frames leading to incorrect stack traces. This vulnerability affects Firefox 128 and Thunderbird 128...

CVE-2024-37873: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in viewpayslip.php in Itsourcecode Payroll Management System Project In PHP With Source Code 1.0 allows remote attackers to execute arbitrary SQL commands via the id parameter...

CVE-2024-37871: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in Itsourcecode Online Discussion Forum Project in PHP with Source Code 1.0 allows remote attackers to execute arbitrary SQL commands via the email parameter...

MAL-2024-7425 Malicious code in fake-package-apache-with-copyleft-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dccffa1d5f84a8476d98fd5eed5c0401aba753ef0916b506d1b8f9687029351d The OpenSSF Package Analysis project identified 'fake-package-apache-with-copyleft-dep' @ 4.0.0 npm as malicious. It is considered malicious...

WordPress Image Hover Effects for Elementor with Lightbox and Flipbox plugin <= 3.0.2 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Khalid Patchstack Alliance in WordPress Plugin Image Hover Effects - Caption Hover with Carousel versions = 3.0.2...

CVE-2024-37546: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in biplob018 Image Hover Effects - Caption Hover with Carousel allows Stored XSS.This issue affects Image Hover Effects - Caption Hover with Carousel: from n/a through 3.0.2...

MAL-2024-7155 Malicious code in @zitterorg/deserunt-beatae-fuga (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9102b6b1b9c0603fe9968c593b5a7500377a6ac0843e6595dc438c9b75e213f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7089 Malicious code in cra-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e49ccaa79a7296b7f1237beb3210cabf6610aab5c68e2c349b1fff4d3b2bb332 The OpenSSF Package Analysis project identified 'cra-docs' @ 7.999.45 npm as malicious. It is considered malicious because: - The package...

SUSE CVE-2024-37298

gorilla/schema converts structs to and from form values. Prior to version 1.4.1 Running schema.Decoder.Decode on a struct that has a field of type struct... opens it up to malicious attacks regarding memory allocations, taking advantage of the sparse slice functionality. Any use of...

CVE-2024-32853: Execution with Unnecessary Privileges

Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges...

Go SDK for CloudEvents's use of WithRoundTripper to create a Client leaks credentials

...

Proxy-Authorization header not cleared on cross-origin redirect in fetch in Undici

...

CVE-2024-5819: Improper Neutralization of Input During Web Page Generation

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to DOM-based Stored Cross-Site Scripting via HTML data attributes in all versions up to, and including, 3.2.45 due to insufficient input sanitization and output escaping on user supplied...

MAL-2024-7049 Malicious code in @yu-life/yulife-bdd-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8dfe091de922cc251578223955b74b56ade98fa67b719bcaa584d3403602f992 The OpenSSF Package Analysis project identified '@yu-life/yulife-bdd-framework' @ 0.0.72 npm as malicious. It is considered malicious because: -...

CVE-2024-5424

CVE-2024-5424 affects Gallery Blocks with Lightbox (WordPress plugin) and is caused by insufficient input sanitization/escaping in the galleryID and className parameters, enabling Stored XSS. The vulnerability is exploitable by authenticated users with Contributor-level access or higher, affectin...

CVE-2024-5424: Improper Neutralization of Input During Web Page Generation

The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to...

PT-2024-36118

Name of the Vulnerable Software and Affected Versions: The Gallery Blocks with Lightbox plugin for WordPress versions up to, and including, 3.2.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...