MAL-2024-7868 Malicious code in wix-smarts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df57af06b1b5cd455e4d81a7d9979d518578a2b49fd8b99019d721270edefa65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-5975

The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-5975

The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-5975 CZ Loan Management <= 1.1 - Unauthenticated SQLi

The CZ Loan Management WordPress plugin through 1.1 does not properly sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

CVE-2024-5975

The CVE-2024-5975 entry concerns the CZ Loan Management WordPress plugin (versions ≤ 1.1). It describes an unauthenticated SQL injection caused by improper sanitization/escaping of a parameter used in a SQL statement via an AJAX action. Impact notes indicate unauthenticated attackers can perform ...

PT-2024-17137 · Automationdirect · C-More Ea9 Eap9

Name of the Vulnerable Software and Affected Versions: AutomationDirect C-More EA9 EAP9 affected versions not specified Description: The issue is a remote code execution vulnerability due to memory corruption in the analysis of AutomationDirect C-More EA9 EAP9 files. This allows remote attackers ...

MAL-2024-7847 Malicious code in ent-widget-citizenship (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cf62b2434507ed956589c6ccdb8a0361e0f7711f7625eb142f7d046a2dfc20d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OneDrive Pastejacking

OneDrive Pastejacking: The crafty phishing and downloader campaign By Rafael Pena · July 29, 2024 Over the past few weeks, the Trellix Advanced Research Center has observed a sophisticated Phishing/downloader campaign targeting Microsoft OneDrive users. This campaign heavily relies on social...

PT-2024-38162 · Sourcecodester · Sourcecodester Complaint Management System

Name of the Vulnerable Software and Affected Versions: SourceCodester Complaints Report Management System version 1.0 Description: A problematic issue has been found in the system, affecting the processing of the file "/admin/ajax.php?action=save settings". The manipulation of the name argument...

CVE-2024-7157

A vulnerability was found in TOTOLINK A3100R 4.1.2cu.5050B20200504. It has been classified as critical. This affects the function getSaveConfig of the file /cgi-bin/cstecgi.cgi?action=save&setting. The manipulation of the argument httphost leads to buffer overflow. It is possible to initiate the...

MAL-2024-11714 Malicious code in stackstorm-runner-action-chain (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0cc9e6be890f15ba83b67af002dc0fdec59a68ebdd2696ab5168df443ed2dabf Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in stackstorm-runner-action-chain (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0cc9e6be890f15ba83b67af002dc0fdec59a68ebdd2696ab5168df443ed2dabf Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

PT-2024-37884 · Irfan Skiljan · Irfanview

Name of the Vulnerable Software and Affected Versions: IrfanView affected versions not specified Description: This issue allows remote attackers to execute arbitrary code on affected installations of IrfanView. User interaction is required to exploit this issue, where the target must visit a...

PT-2024-29593 · Adobe · Indesign Desktop

Name of the Vulnerable Software and Affected Versions: InDesign Desktop versions ID18.5.2, ID19.3 and earlier Description: The issue is a NULL Pointer Dereference that could lead to an application denial-of-service DoS condition. An attacker could exploit this to crash the application, resulting ...

MAL-2024-7785 Malicious code in sap-abort (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4e2bde6bdff35f1e9b3c13cc8e0202b7b2b76d1390e81fc3ea3d484340f5f3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-39680

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users...

CVE-2024-39681

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users...

CVE-2024-39680 WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users...

CVE-2024-6830

A vulnerability, which was classified as critical, was found in SourceCodester Simple Inventory Management System 1.0. Affected is an unknown function of the file action.php of the component Order Handler. The manipulation of the argument orderid leads to sql injection. It is possible to launch t...

CVE-2024-39700 Remote Code Execution (RCE) vulnerability in jupyterlab extension template `update-integration-tests` GitHub Action

JupyterLab extension template is a copier template for JupyterLab extensions. Repositories created using this template with test option include update-integration-tests.yml workflow which has an RCE vulnerability. Extension authors hosting their code on GitHub are urged to upgrade the template to...