MAL-2024-11976 Malicious code in eritiopitop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d15b644f2a4d79a062d6c3a7af975bc368236569d54382196034bcb9a8f42938 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12048 Malicious code in tournament_service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a51c146ed2933a7f62a56c8bcf7aca713a310334900137f2667c9dbafbfb204 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in component-detection-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 612def523e2e2b3cd483831188b3e68f79f2575bc19954cc24088532608f7798 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12020 Malicious code in payment-tx-params-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6861efcfa7f8e30a646e9a76387e80446245c2f7ce4966e55da1c8e6d34fcd9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in action-testtttt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76afe05559b1759ff69fe0657362b303c6e8bff5a5221305fe01dd0842a1e5f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in actions-languageservices (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6468057d6ae17756ec02b7293da5160697424f26a39e172bce32c38a2b2337b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12039 Malicious code in setup-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3cd9285f7d743a645d9b4834df4d7f61b6cc9bd314cf339252e7458d0f61244 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11965 Malicious code in dependency-review-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb9bad81419f4cfa2078b1228e521070aa1d15f91e26a58d7ee754871cd614c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dependency-review-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb9bad81419f4cfa2078b1228e521070aa1d15f91e26a58d7ee754871cd614c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-17138 · Netskope · Netskope Endpoint Dlp

Name of the Vulnerable Software and Affected Versions: Netskope Endpoint DLP versions prior to R119 Description: A security issue arises from a double-fetch problem in the Content Control Driver of Netskope Endpoint DLP, leading to a heap overflow. This occurs because the NumberOfBytes argument t...

Avada < 7.11.11 - Cross-Site Request Forgery

Description The Avada theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 7.11.10. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action via a forged...

Malicious code in label-merge-conflicts-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0f4e7055373f34da86b2f4a870acff07073a74806372655dd69ac315c6c598d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-MATTERMOST-2024-2447

Mattermost versions 8.1.x before 8.1.11, 9.3.x before 9.3.3, 9.4.x before 9.4.4, and 9.5.x before 9.5.2 fail to authenticate the source of certain types of post actions, allowing an authenticated attacker to create posts as other users via a crafted post action...

Malicious code in action-mattermost-notify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff777c42ea9a589391478ecfd89da15137033e8ce5e0961b26f277f6e055c70e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11836 Malicious code in action-mattermost-notify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff777c42ea9a589391478ecfd89da15137033e8ce5e0961b26f277f6e055c70e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-11012 Notibar – Notification Bar for WordPress <= 2.1.4 - Authenticated (Subscriber+) Arbitrary Shortcode Execution via njt_nofi_text

The The Notibar – Notification Bar for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution via njtnofitext AJAX action in all versions up to, and including, 2.1.4. This is due to the software allowing users to execute an action that does not properly validate a value...

MAL-2024-11832 Malicious code in imran-downloader-servar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0ed3c408311c79c6c881bf500f227a981d7cd2c0908cb00a0bd010e9d5352bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Authorities Shut Down 27 DDoS-for-Hire Platforms, Arrest 3 Admins

Just in time for the holidays!...

CVE-2024-8233

Removed by vendor...

CVE-2024-12333

The Woodmart theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 8.0.3. This is due to the software allowing users to execute an action that does not properly validate a value before running doshortcode through the woodmartinstagramajaxquery AJ...