Malicious code in pay-with-bitpay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6ebb5b5e2e2c9c966ed6bc7d57b453bf509a83fba50883992e0cd8b8773deb8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in module-with-node-file (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43899bbadfa822b75785b94f54888eae361be60ed7fb7b372bedf319e5f34ff3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5477 Malicious code in project-with-joe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8525d5937e4a5be8a6ced4cb21f911a2a42b3b3d2149512ef57416af1b3c26b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in project-with-joe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8525d5937e4a5be8a6ced4cb21f911a2a42b3b3d2149512ef57416af1b3c26b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grunt-with-node-sass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0946d8ce554c4342a4ca8846ecb6a66703712bbf720809ce3fdfade36925b648 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-14069

Name of the Vulnerable Software and Affected Versions Custom Share Buttons with Floating Sidebar WordPress plugin versions prior to 4.2 Description The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks when the unfiltered html capability is...

CVE-2022-1717: Improper Neutralization of Input During Web Page Generation

The Custom Share Buttons with Floating Sidebar WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed...

NVIDIA DGX 缓冲区错误漏洞

NVIDIA DGX is a high-performance workstation for deep learning applications from NVIDIA. The NVIDIA DGX A100 suffers from a buffer error vulnerability that originates from a boundary error in the SBIOS in SmbiosPei. An attacker could exploit this vulnerability to trigger out-of-bounds writes and...

Cloudflare Public Bug Bounty: Sign in with Apple generates long-life JWTs, seemingly irrevocable, that grant immediate access to accounts

The OIDC JWT token issued on a new Sign in with Apple ID to the Cloudflare Dashboard had an excessive lifetime. When intercepted by a malicious actor, it enabled impersonation of the affected user on multiple devices during the entire token validity period without the need to re-authenticate. The...

Cloudflare Public Bug Bounty: Sign in with Apple works on existing accounts, bypasses 2FA

It was possible to bypass configured Cloudflare 2FA when logging in to a Cloudflare account using Apple ID authentication flow. A malicious actor could access a Cloudflare account by setting up an Apple ID account using e-mail address matching the one used to set up the targeted account. The issu...

CVE-2022-1692: Improper Neutralization of Special Elements used in an SQL Command

The CP Image Store with Slideshow WordPress plugin before 1.0.68 does not sanitise and escape the orderingby query parameter before using it in a SQL statement in pages where the codepeople-image-store is embed, allowing unauthenticated users to perform an SQL injection attack...

SUSE: Security Advisory (SUSE-SU-2022:1920-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ALPINE-CVE-2022-27774

An insufficiently protected credentials vulnerability exists in curl 4.9 to and include curl 7.82.0 are affected that could allow an attacker to extract credentials when follows HTTPS redirects is used with authentication could leak credentials to other services that exist on different protocols ...

CVE-2022-31971: Improper Neutralization of Special Elements used in an SQL Command

ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simplechatbot/admin/?page=responses/viewresponse&id=...

PT-2022-21004

Name of the Vulnerable Software and Affected Versions ChatBot App with Suggestion version 1.0 Description The issue allows deletion of any file via the /simple chat bot/classes/Master.php API endpoint with the f parameter set to delete img. Recommendations For ChatBot App with Suggestion version...

CVE-2022-31970: Improper Neutralization of Special Elements used in an SQL Command

ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simplechatbot/admin/?page=responses/manageresponse&id=...

PT-2022-21005

Name of the Vulnerable Software and Affected Versions ChatBot App with Suggestion version 1.0 Description The issue concerns SQL Injection, which can be exploited via the "/simple chat bot/admin/?page=user/manage user&id=" API endpoint. This allows for potential manipulation of database queries...

CVE-2022-31966: Undefined Security Weakness

ChatBot App with Suggestion v1.0 is vulnerable to Delete any file via /simplechatbot/classes/Master.php?f=deleteimg...

CVE-2022-31969: Improper Neutralization of Special Elements used in an SQL Command

ChatBot App with Suggestion v1.0 is vulnerable to SQL Injection via /simplechatbot/admin/?page=user/manageuser&id=...

WordPress Amazon Link plugin跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Amazon Link plugin 3.2.10 and earlier versions have a cross-site scripting vulnerability th...