MAL-2024-7049 Malicious code in @yu-life/yulife-bdd-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8dfe091de922cc251578223955b74b56ade98fa67b719bcaa584d3403602f992 The OpenSSF Package Analysis project identified '@yu-life/yulife-bdd-framework' @ 0.0.72 npm as malicious. It is considered malicious because: -...

CVE-2024-5424

CVE-2024-5424 affects Gallery Blocks with Lightbox (WordPress plugin) and is caused by insufficient input sanitization/escaping in the galleryID and className parameters, enabling Stored XSS. The vulnerability is exploitable by authenticated users with Contributor-level access or higher, affectin...

PT-2024-36118

Name of the Vulnerable Software and Affected Versions: The Gallery Blocks with Lightbox plugin for WordPress versions up to, and including, 3.2.1 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2024-5424: Improper Neutralization of Input During Web Page Generation

The Gallery Blocks with Lightbox. Image Gallery, HTML5 video , YouTube, Vimeo Video Gallery and Lightbox for native gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘galleryID’ and 'className' parameters in all versions up to, and including, 3.2.1 due to...

CVE-2024-5289: Improper Neutralization of Input During Web Page Generation

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Google Maps widget parameters in all versions up to, and including, 3.2.42 due to insufficient input sanitization and output escaping. This makes it possibl...

PT-2024-35474

Name of the Vulnerable Software and Affected Versions: The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress versions up to, and including, 3.2.42 Description: The issue is related to Stored Cross-Site Scripting via the Google Maps widget parameters due to...

Malicious code in ar_find-in-batches-with-order (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6666 Malicious code in ar_find-in-batches-with-order (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in acts-as_commentable_with_replies (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6489 Malicious code in acts-as_commentable_with_replies (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in down_load_ebook_there_with_you_by_samantha_young_1tlii (npm)

--- -= Per source details. Do not edit below this line.=-...

June 25, 2024—KB5039299 (OS Build 19045.4598) Preview

None None...

cloudevents/sdk-go: usage of WithRoundTripper to create a Client leaks credentials

A vulnerability was found in cloudevents/sdk-go. This issue involves using cloudevents.WithRoundTripper to create a cloudevents.Client with an authenticated http.RoundTripper results in the go-sdk leaking credentials to arbitrary endpoints. When the transport is populated with an authenticated...

MAL-2024-1641 Malicious code in @wdpx/themes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 027f3f6ecca8b2d2bd6a4d8c6b358eb1ea8ea1f094cfe3d2606095b6b17d822f The OpenSSF Package Analysis project identified '@wdpx/themes' @ 3.0.2 npm as malicious. It is considered malicious because: - The package...

PT-2024-37401

Name of the Vulnerable Software and Affected Versions: Login with phone number plugin for WordPress versions up to, and including 1.7.34 Description: The issue is related to the generation of weak reset codes and the lack of attempt or time limits for password resets. This allows unauthenticated...

WordPress plugin Login with phone number security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2024-4450: Missing Authorization

The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the ImportAjaxController.php file in all versions up to, and including, 3.3.6. This makes it possible for authenticated attackers, with...

CVE-2024-2381: Unrestricted Upload of File with Dangerous Type

The AliExpress Dropshipping with AliNext Lite plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the ajaxsaveimage function in all versions up to, and including, 3.3.5. This makes it possible for authenticated attackers, with subscriber-level acces...

CVE-2024-6125: Weak Password Recovery Mechanism for Forgotten Password

The Login with phone number plugin for WordPress is vulnerable to unauthorized password resets in versions up to, and including 1.7.34. This is due to the plugin generating too weak a reset code, and the code used to reset the password has no attempt or time limit. This makes it possible for...

MAL-2024-1630 Malicious code in mvp-website-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 89574af4bb00d4c540ffc8651f5ef4bcc0f72af2368ee6e32346807e91d2e8a0 The OpenSSF Package Analysis project identified 'mvp-website-html' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...