Rails Action Pack 跨站脚本漏洞

Rails Action Pack is a web framework from the US Rails team. It provides a mechanism for routing mapping request URLs to actions, defining controllers that implement actions, and generating responses by rendering views templates in various formats. A cross-site scripting vulnerability exists in...

CVE-2024-45760

Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains an improper access control vulnerability. A remote low privileged user could potentially exploit this vulnerability via the HTTP GET method leading to unauthorized action with elevated privileges...

MAL-2024-11595 Malicious code in ffefesaewad (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11433 Malicious code in release-automation-action (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in release-automation-action (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11279 Malicious code in @saleswhale/barnacle (npm)

--- -= Per source details. Do not edit below this line.=-...

CVE-2024-11457

The CVE-2024-11457 vulnerability affects the WordPress plugin Feedpress Generator – External RSS Frontend Customizer (

CVE-2024-8679

CVE-2024-8679 affects the Library Management System WordPress plugin (Library Management System) up to version 3.0.0. It allows SQL Injection via the value parameter of the owt_lib_handler AJAX action. The flaw arises from insufficient escaping and lack of proper query preparation, enabling an au...

PT-2024-9301 · WordPress · Wp Umbrella

Name of the Vulnerable Software and Affected Versions: WP Umbrella: Update Backup Restore & Monitoring plugin for WordPress versions up to, and including, 2.17.0 Description: The issue is related to Local File Inclusion, which makes it possible for unauthenticated attackers to include and execute...

Europol takes down criminal data hub Manson Market in busy month for law enforcement

A coordinated action between several European law enforcement agencies shut down an online marketplace called Manson Market that sold stolen data to any interested cybercriminal. What made this market attractive for cybercriminals was that they could buy data sorted by region and account balance...

CVE-2024-11729

CVE-2024-11729 affects the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin. The vulnerability is an SQL Injection via the get_widget_payment_options AJAX action, triggered by the parameter service_list[0][service_id]. It exists in all versions up to and including 3.6.4 due to...

CVE-2024-10836

The Flixita theme for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘id’ parameter in all versions up to, and including, 1.0.82 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

PT-2024-16635 · WordPress · Pojo Forms

Name of the Vulnerable Software and Affected Versions: Pojo Forms plugin for WordPress versions 1.4.7 and earlier Description: The Pojo Forms plugin for WordPress is vulnerable to arbitrary shortcode execution via the form preview shortcode AJAX action. This is due to the software allowing users ...

CVE-2024-10937 Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins <= 2.0.58 - Sensitive Information Exposure

The Related Posts, Inline Related Posts, Contextual Related Posts, Related Content By PickPlugins plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.0.58 via the wpajaxnoprivrelatedpostajaxgetpostids AJAX action. This makes it possible for...

CVE-2023-6978 WP Job Manager – Company Profiles <= 1.7 - Reflected Cross-Site Scripting

The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'company' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2023-6978 WP Job Manager – Company Profiles <= 1.7 - Reflected Cross-Site Scripting

The WP Job Manager – Company Profiles plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'company' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inje...

CVE-2023-52944

Incorrect authorization vulnerability in ActionRule webapi component in Synology Surveillance Station before 9.2.0-11289 and 9.2.0-9289 allows remote authenticated users to perform limited actions on the set action rules function via unspecified vectors...

MAL-2024-11196 Malicious code in set-pr-description-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f56192a6739bfa4e2f9794840d334d8216ea18d4086cf066b6eeded90d8bbfb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-10952

The The Authors List plugin for WordPress is vulnerable to arbitrary shortcode execution via updateauthorslistajax AJAX action in all versions up to, and including, 2.0.4. This is due to the software allowing users to execute an action that does not properly validate a value before running...

CVE-2024-11807 NPS computy <= 2.8.0 - Reflected Cross-Site Scripting

The NPS computy plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'data1' and 'data2' parameters in all versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...