WordPress WordPress Contact Forms by Cimatti plugin <= 1.9.2 - Cross-Site Request Forgery via process_bulk_action Function vulnerability

Cross-Site Request Forgery via processbulkaction Function vulnerability discovered by vgo0 in WordPress Plugin Contact Forms by Cimatti versions = 1.9.2...

Malicious code in action-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47502de1954b1ba4d201ac64813edf79362d7f81fb2c28f6802f800d93bc08d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11026 Malicious code in action-deploy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47502de1954b1ba4d201ac64813edf79362d7f81fb2c28f6802f800d93bc08d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11098 Malicious code in soybean-admin-tab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 074138690c6a5d6116a3c95a8c03d5436314502580eb4f3858a6a4041b287e34 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11077 Malicious code in repository-dispatch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6945fe41e15be899900e8df18381144d95f14a8645f686d9b4c96f755e46f8d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11099 Malicious code in spid-gc-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad2d0454e042159c3e89571e4e8154f79b74c2c9e8f588592a42ffb54b87dc69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11095 Malicious code in simplified-jsbridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03625e35d3d19ce9741a3802fa6ce9153b5e0717d124793e8e00fdbf2bb0f71f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11111 Malicious code in transify-helper-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fe9a95aa86c804ea93c96457c3f8ef18a9415c888ae5921213386c8424038ef Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11106 Malicious code in sss2h (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cfa752a5ead97e589945fc73774a2148ca64081dea5057c94d6b6ee2bf90e97 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11029 Malicious code in babelcl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d06bcaaea23cb4957729868259d43ca4c69f5887e9896cd4cae87623475fcfb3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10980 Malicious code in internallib_v605 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 475f2a81a117feeb57828a0b3a4f83fa7b1ef8ea775453479c98d169afa6fb42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10998 Malicious code in rct-centered-text (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dc6a8e05244932d5a9c6a3e845c59c4313f962558c160bf03c579325473646d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11018 Malicious code in web_enhance_sap-stable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1166fb5c2d52c1441f6a01e18fa740ebce1a9f89427d2f5211a45eeadba3cb88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-16340 · Cimatti · Wordpress Contact Forms By Cimatti

Name of the Vulnerable Software and Affected Versions: WordPress Contact Forms by Cimatti plugin for WordPress version 1.9.2 and earlier Description: The issue is due to missing or incorrect nonce validation on the process bulk action function, making it possible for unauthenticated attackers to...

CVE-2024-22117

When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding...

CVE-2024-22117

CVE-2024-22117 describes a bug in the map element URL handling where the system increments sysmapelementurlid and a manual change (sysmapelementurlid + 1) can prevent others from adding URLs. Public advisories (NVD entry and OSV listings) reference the same issue, with vendor advisories noting th...

CVE-2024-22117 Value of sysmap_element_url can be de-synchronized causing the map element to crash when new URLs is added

When a URL is added to the map element, it is recorded in the database with sequential IDs. Upon adding a new URL, the system retrieves the last sysmapelementurlid value and increments it by one. However, an issue arises when a user manually changes the sysmapelementurlid value by adding...

CVE-2024-11202

Multiple plugins for WordPress are vulnerable to Reflected Cross-Site Scripting via the cmindsfreeguide shortcode in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-11002

The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpostgallerygetshortcodetemplate AJAX action in all versions up to, and including, 2.1.4.2. This is due to the software allowing users to execute an action that does not properly validate a value...

CVE-2024-11002

The The InPost Gallery plugin for WordPress is vulnerable to arbitrary shortcode execution via the inpostgallerygetshortcodetemplate AJAX action in all versions up to, and including, 2.1.4.2. This is due to the software allowing users to execute an action that does not properly validate a value...