MAL-2024-10955 Malicious code in commitlint-plugin-rules-an (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c03c634d44275626fafed374fe4584c0eb7ad65b4962926f8cdf2a8baf76dfc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10978 Malicious code in icf-react-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8361b152fc7c673dc95e4055a36459ced57bfc88a733b5e9543c2dc07914156a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-16694 · WordPress · Inpost Gallery

Name of the Vulnerable Software and Affected Versions: InPost Gallery plugin for WordPress versions up to, and including, 2.1.4.2 Description: The issue allows authenticated attackers with Subscriber-level access and above to execute arbitrary shortcodes due to the software not properly validatin...

PT-2024-9104 · Fuji Electric · Fuji Electric Monitouch V-Sft

Name of the Vulnerable Software and Affected Versions: Fuji Electric Monitouch V-SFT affected versions not specified Description: The issue is related to an out-of-bounds write in the parsing of V9C files, which can be exploited by remote attackers to execute arbitrary code on affected...

MAL-2024-10940 Malicious code in nodmialer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f517fd7c243bbf2ebdbc660388ec85202c4ea31c094bc01cbb8b5ff4c0c7388f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-5XR6-XHWW-33M4 Artifact poisoning vulnerability in action-download-artifact v5 and earlier

Summary In versions of dawidd6/action-download-artifact before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts such as malicious executables into a privileged...

Artifact poisoning vulnerability in action-download-artifact v5 and earlier

Summary In versions of dawidd6/action-download-artifact before v6, a repository's forks were also searched by default when attempting to find matching artifacts. This could be exploited by an unprivileged attacker to introduce compromised artifacts such as malicious executables into a privileged...

MAL-2024-10920 Malicious code in conibase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e70af172c9db7c1934d326429c7bc63ed721d3934ada0d8197542fb231535fec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10923 Malicious code in delta-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a63f8d77e78e8b2cbc3bc3bfa80ee50373c5e9eb8cd9962c51a4a0ebec4b7cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-40108 · Github Actions · Dawidd6/Action-Download-Artifact

Name of the Vulnerable Software and Affected Versions: dawidd6/action-download-artifact versions prior to v6 Description: The issue allows an unprivileged attacker to introduce compromised artifacts into a privileged workflow context by exploiting the default behavior of searching a repository's...

CVE-2024-11034

The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable to arbitrary shortcode execution via firecontactform AJAX action in all versions up to, and including, 1.4. This is due to the software...

CVE-2024-11034

The CVE-2024-11034 entry concerns the WordPress plugin “Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation.” Connected sources confirm that all versions up to and including 1.4 are vulnerable to arbitrary shortcode execution via the...

CVE-2024-11034 Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation <= 1.4 - Unauthenticated Arbitrary Shortcode Execution via fire_contact_form

The The Request a Quote for WooCommerce and Elementor – Get a Quote Button – Product Enquiry Form Popup – Product Quotation plugin for WordPress is vulnerable to arbitrary shortcode execution via firecontactform AJAX action in all versions up to, and including, 1.4. This is due to the software...

CVE-2024-11361

The PDF Invoices & Packing Slips Generator for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 2.2.1. This makes it possible for unauthenticated attackers t...

CVE-2024-10880

The JobBoardWP – Job Board Listings and Submissions plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg & removequeryarg without appropriate escaping on the URL in all versions up to, and including, 1.3.0. This makes it possible for unauthenticated...

MAL-2024-10883 Malicious code in codeql-extractor-iac-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3f77f847f2c7d09571ef2516734c1d483d434e0980f32c21967900b8d28dd4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-0122

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure...

CVE-2024-0122

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure...

CVE-2024-0122

NVIDIA Delegated Licensing Service (DLS) for all appliance platforms is affected by CVE-2024-0122. The issue enables an attacker to cause an unauthorized action, with potential partial denial of service and confidential information disclosure. Affected DLS versions include 2.1, 3.1, 3.1.1, 3.1.2,...

CVE-2024-0122

NVIDIA Delegated Licensing Service for all appliance platforms contains a vulnerability where an attacker may cause an unauthorized action. A successful exploit of this vulnerability may lead to partial denial of service and confidential information disclosure...