MAL-2022-5807 Malicious code in ringcentral-js-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40a945280fbb86a94c48945655c54a4c0e8a086449b740490e8167ac97f1de67 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7146 Malicious code in widgets-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dc0d7136253d49aca8073d2094c4733e7491db9517189c6c7606c6a6ee7c44c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in widgets-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dc0d7136253d49aca8073d2094c4733e7491db9517189c6c7606c6a6ee7c44c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Design/Logic Flaw

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retriev...

Tuleap 安全漏洞

Tuleap is open source an application lifecycle management system that facilitates agile software development, design projects, V-modeling, requirements management and IT service management. A security vulnerability exists in versions prior to Tuleap 13.7.99.239 that stems from Tuleap failing to...

CVE-2022-24896 Tracker report renderer and chart widgets leak information in Tuleap

Tuleap is a Free & Open Source Suite to manage software developments and collaboration. In versions prior to 13.7.99.239 Tuleap does not properly verify authorizations when displaying the content of tracker report renderer and chart widgets. Malicious users could use this vulnerability to retriev...

CVE-2022-24896

CVE-2022-24896 affects Tuleap versions prior to 13.7.99.239. The vulnerability stems from improper authorization checks when displaying content in the Tracker Report Renderer and Chart widgets, allowing an attacker to disclose the name of trackers and the fields used in reports. Impact is informa...

Malicious code in survey-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2112bbae1e65790567a0ca80131bd2fef3b3ba74e669e0dcbc8f409d3291fff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6362 Malicious code in survey-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2112bbae1e65790567a0ca80131bd2fef3b3ba74e669e0dcbc8f409d3291fff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-3X9X-VHQJ-CV27 Magento XML Injection vulnerability in the Widgets Update Layout

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

Magento XML Injection vulnerability in the Widgets Update Layout

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

Magento XML Injection vulnerability in the Widgets Module

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

GHSA-P746-QW73-QMMX Magento XML Injection vulnerability in the Widgets Module

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

GHSA-MW95-GMW4-883P Magento XML injection in the Widgets module

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

Magento XML injection in the Widgets module

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

GHSA-V287-9W3V-X5C5 Total.js CMS RCE Vulnerability

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...

Total.js CMS RCE Vulnerability

An issue was discovered in Total.js CMS 12.0.0. An authenticated user with the widgets privilege can gain achieve Remote Command Execution RCE on the remote server by creating a malicious widget with a special tag containing JavaScript code that will be evaluated server side. In the process of...

May 24, 2022—KB5014019 (OS Build 22000.708) Preview

None None...

Sideblog <= 6.0 - Arbitrary Settings Update via CSRF to Stored XSS

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping " document.getElementById"test".submit; The XSS will be...

@binary-com/binary-style (>=0.2.4, <=0.2.26), @dfeidao/widgets (>=4.6.201904011830, <=4.6.201904291719) +10 more potentially affected by CVE-2016-10744 via select2 (>=4.0.1, <=4.0.5)

select2 NPM version =4.0.1, =0.2.4, =4.6.201904011830, =0.1.0, =2.3.1, =0.11.28, =0.0.1, =0.1.0, =0.0.1, =1.0.0, =1.0.1 Source cves: CVE-2016-10744 Source advisory: OSV:GHSA-RF66-HMQF-Q3FC...