MAL-2023-8099 Malicious code in brum-global-variable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57eb73c6cef367bf2c5464967ed374a34f64862b3598ebae764c8b292f5d47e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-4916: Cross-Site Request Forgery (CSRF)

The Login with phone number plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.6. This is due to missing nonce validation on the 'lwpupdatepasswordaction' function. This makes it possible for unauthenticated attackers to change user password via...

WordPress plugin Login with phone number Cross-site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. The WordPress plugin Login with phone number suffer...

Exiv2 Loop DoS

The vulnerability of the Exiv2 metadata management library relates to the execution of a loop with an unreachable exit condition. Exploiting this vulnerability could allow an attacker to cause a service failure...

Security Bulletin: Multiple security vulnerabilities Affect IBM Db2 Database Server shipped with IBM OpenPages

Summary IBM® Db2® Database Server is shipped as a supporting program of IBM OpenPages. Information about a security vulnerability affecting IBM Db2 Database Server has been published in multiple security bulletins. Vulnerability Details Refer to the security bulletins listed in the...

Oracle Linux 8 : libarchive (ELSA-2019-3698)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-3698 advisory. - fix out-of-bounds read within lhareaddatanone CVE-2017-14503 - fix crash on crafted 7zip archives CVE-2019-1000019 Tenable has extracted the precedin...

CVE-2023-38516: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in WP OnlineSupport, Essential Plugin Audio Player with Playlist Ultimate plugin = 1.2.2 versions...

CVE-2023-37997

CVE-2023-37997 : Unauthenticated Reflected Cross-Site Scripting vulnerability in the WordPress plugin “Post List With Featured Image” (Dharmesh Patel), affecting versions <= 1.2 (WordPress plugin) and also cited as

CVE-2023-37997: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Dharmesh Patel Post List With Featured Image plugin = 1.2 versions...

CVE-2023-31175

An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system. See Instruction Manual Appendix A and Appendix E dated 20230615 for more...

CVE-2023-31175: Execution with Unnecessary Privileges

An Execution with Unnecessary Privileges vulnerability in the Schweitzer Engineering Laboratories SEL-5037 SEL Grid Configurator could allow an attacker to run system commands with the highest level privilege on the system. See Instruction Manual Appendix A and Appendix E dated 20230615 for more...

CVE-2023-1995: Insufficient Logging

Insufficient Logging vulnerability in Hitachi HiRDB Server, HiRDB Server With Addtional Function, HiRDB Structured Data Access Facility.This issue affects HiRDB Server: before 09-60-39, before 09-65-23, before 09-66-17, before 10-01-10, before 10-03-12, before 10-04-06, before 10-05-06, before...

CVE-2023-32797: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in I Thirteen Web Solution video carousel slider with lightbox plugin = 1.0.22 versions...

CVE-2023-4511 Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark

BT SDP dissector infinite loop in Wireshark 4.0.0 to 4.0.7 and 3.6.0 to 3.6.15 allows denial of service via packet injection or crafted capture file...

MAL-2023-1561 Malicious code in cncf-interactive-landscape (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8d2b9d2c5124b5a628ea48abf890a34baae186cb6a3844fc2617ad57b21be8d9 The OpenSSF Package Analysis project identified 'cncf-interactive-landscape' @ 1.0.6 npm as malicious. It is considered malicious because: - The...

H-05 Unmitigated

Lines of code Vulnerability details Issue not mitigated About the problem sponsor function allows caller to delegate his shares to the special address. In this case caller losses ability to win prizes. Previous version of code had sponsor function, which allowed to deposit funds on behalf of owne...

MAL-2023-1500 Malicious code in wpi-rules-valid-events (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1f8f8319f361dae60da61058ccd4776881160f6a820fbad5fe51373e6084e45b The OpenSSF Package Analysis project identified 'wpi-rules-valid-events' @ 6.6.6 npm as malicious. It is considered malicious because: - The...

MAL-2023-1469 Malicious code in flowtorch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6c2c3f2d7423991d07fec2693f59f64eaa2f3a3d0122fbf6f05e19a6d2a40871 The OpenSSF Package Analysis project identified 'flowtorch' @ 9.2.2 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1107 Malicious code in @tendable/ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 530df54e3b7520850cd182b11fa3bb60f72e996b941a80467c006de084372f29 The OpenSSF Package Analysis project identified '@tendable/ui-kit' @ 99.0.1 npm as malicious. It is considered malicious because: - The package...

Siemens SICAM TOOLBOX II 安全漏洞

SICAM TOOLBOX II is an engineering solution for plants and systems of all sizes. It allows data collection, data modeling, configuration and parameterization. It is used for process information engineering of automation and central control room systems. Siemens SICAM TOOLBOX II has an Execute wit...