CVE-2021-47157

The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling...

CVE-2021-47157

The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling...

brasseler.marcant.net Cross Site Scripting vulnerability OBB-3876483

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2021-47157

The Kossy module for Perl , developed by Masahiro Nagano, is vulnerable to JSON hijacking in versions prior to 0.60 . The root cause is the improper handling of the X-Requested-With header, which allows an attacker to bypass security measures to hijack JSON data. To remediate this vulnerability, ...

CVE-2021-47157

The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling...

CVE-2021-47157

The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling...

CVE-2021-47157

The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling...

CVE-2021-47157: Origin Validation Error

The Kossy module before 0.60 for Perl allows JSON hijacking because of X-Requested-With mishandling...

MAL-2024-1110 Malicious code in abcotv-constants (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aecde97eb6bd30d0ab5c8787d1bd2f6d5fe38f5078d015135b8e267e5558b89e The OpenSSF Package Analysis project identified 'abcotv-constants' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in formvalidationtestauth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dcf38fb613aff5c787e7fb76b6868b7902d77add08013947cf91edacbac4f077 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1106 Malicious code in lyft-stats (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a187384a19b081ac529bfe65d79397f4521255a67fb44dd29c1bc8cc5220fe42 The OpenSSF Package Analysis project identified 'lyft-stats' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...

MAL-2024-1103 Malicious code in lyft-requests (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d60f1a244bc4a4509672cc7a34d1db4ee83618066b02f41f15a6573ff6f5a2ff The OpenSSF Package Analysis project identified 'lyft-requests' @ 5.9.1 pypi as malicious. It is considered malicious because: - The package...

PT-2024-11205 · Kossy · Kossy

Name of the Vulnerable Software and Affected Versions: Kossy module versions prior to 0.60 Description: The issue allows JSON hijacking due to mishandling of the X-Requested-With header. This can be exploited because of improper handling in the Kossy module for Perl. Recommendations: For versions...

CVE-2021-47112

In the Linux kernel, the following vulnerability has been resolved: x86/kvm: Teardown PV features on boot CPU as well Various PV features Async PF, PV EOI, steal time work through memory shared with hypervisor and when we restore from hibernation we must properly teardown all these features to ma...

CVE-2024-1857: Missing Authorization

The Ultimate Gift Cards for WooCommerce – Create, Redeem & Manage Digital Gift Certificates with Personalized Templates plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.6.6 via the wpswgmpreviewemailtemplate. This makes it possible for...

Security Bulletin: Multiple security vulnerabilities in IBM SDK, Java Technology Edition affects IBM OpenPages

Summary IBM® SDK, Java™ Technology Edition is shipped as a supporting program of IBM OpenPages. Information about a security vulnerability affecting IBM SDK, Java Technology Edition has been published in multiple security bulletins. These products have addressed the applicable CVEs. For a complet...

PT-2024-40659 · Unknown · Generatedjavaparser

Name of the Vulnerable Software and Affected Versions: GeneratedJavaParser affected versions not specified Description: A security exception crash has been reported. The crash involves the com.github.javaparser.GeneratedJavaParser.Expression class, the java.base/java.lang.String.startsWith method...

CVE-2024-1772: Deserialization of Untrusted Data

The Play.ht – Make Your Blog Posts Accessible With Text to Speech Audio plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.6.4 via deserialization of untrusted input from the playpodcastdata post meta. This makes it possible for authenticated...

CVE-2024-0976: Improper Neutralization of Input During Web Page Generation

The WP Event Manager – Events Calendar, Registrations, Sell Tickets with WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the plugin parameter in all versions up to, and including, 3.1.41 due to insufficient input sanitization and output escaping. This makes it...

CVE-2024-1690: Missing Authorization

The TeraWallet – Best WooCommerce Wallet System With Cashback Rewards, Partial Payment, Wallet Refunds plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the terawalletexportusersearch function in all versions up to, and including, 1.4.10. This...