Malicious code in hub-rss-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3158b4ecaff25a1c2e806a027dc70cd4f3c129c035ab63635299227ef24766b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3713 Malicious code in hub-rss-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3158b4ecaff25a1c2e806a027dc70cd4f3c129c035ab63635299227ef24766b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6434 Malicious code in teamcity-build-artifacts-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 235e70f767d4caae7345fc80ce5bf59a7609ad9293fb2e2a74f70477ae9cac1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7366 Malicious code in youtrack-personal-timetracking-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 610a58ca854641cb2f1d0a376d543e2d48ba72931f64d153356eac5c176dd1cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in youtrack-personal-timetracking-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 610a58ca854641cb2f1d0a376d543e2d48ba72931f64d153356eac5c176dd1cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pseudo-loc-for-signin-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d100c05109c3b4d84fa03d2463e93fb0b235b5e8f13d497016d190fdbcfc1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5506 Malicious code in pseudo-loc-for-signin-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d100c05109c3b4d84fa03d2463e93fb0b235b5e8f13d497016d190fdbcfc1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2215 Malicious code in courage-for-signin-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 651ba90b6cbf4d05699e79773d63de9bb241b1d23330c1d88b9c2032e8bd52ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in courage-for-signin-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 651ba90b6cbf4d05699e79773d63de9bb241b1d23330c1d88b9c2032e8bd52ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1843 Malicious code in cat-weather-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e88ace5963f5686d2f51198d181864c25de04bd9fa46139da3ecf262068144c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cat-weather-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e88ace5963f5686d2f51198d181864c25de04bd9fa46139da3ecf262068144c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Button Widget Smartsoft <= 1.0.1 - Arbitrary Settings Update to Stored XSS via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as put XSS payloads in them due to the lack of sanitisation and escaping...

WordPress Button Widget Smartsoft plugin <= 1.0.1 - Cross-Site Request Forgery (CSRF) vulnerability to Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability to Cross-Site Scripting XSS was discovered by Ryo Onodera Cryptography Laboratory Tokyo Denki University in the WordPress Button Widget Smartsoft plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of June 8, 2022 a...

WordPress Plugin Latest Tweets Widget Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress plugin Latest Tweets Widget 1.1.4 and prior versions, which stems from a CSRF check...

CVE-2022-1624

The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1624

The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1624

Summary: CVE-2022-1624 affects the WordPress plugin Latest Tweets Widget (versions ≤ 1.1.4). The flaw is a missing CSRF check when updating settings, which could let a logged-in admin be manipulated via CSRF. Sources across NVD, Red Hat, CNVD, CVE List, WPVulnDB, CNNVD and PatchStack corroborate ...

WordPress plugin Latest Tweets Widget 跨站请求伪造漏洞

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress plugin Latest Tweets Widget 1.1.4 and prior versions, which stems from a CSRF check...

Judge.me : XSS in Widget Review Form Preview in settings

Summary: Hi team, I found a XSS vulenrability in the widget review form preview. The payload is added in the success message and triggers when you preview the form Steps To Reproduce: 1. Login to your Shopify account and open Judge.Me App 1. Go to 'Settings' - 'Review Widget' - 'Widget Form' 1. G...

Countdown Timer 跨站脚本漏洞

Countdown Timer is a countdown timer widget for Confluence. A security vulnerability exists in Countdown Timer version 1.7.0, which can be exploited by an attacker to remotely launch a cross-site scripting attack...