X.Org Server RecalculateMasterButtons Out-Of-Bounds Access Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of X.Org Server. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of Button...

Travel Website SQL Injection Vulnerability

Travel Website is a PHP-based travel website. A SQL injection vulnerability exists in Travel Website v1.0, which occurs when the username parameter of the loginAction.php page is processed without filtering before sending the data to the database for processing...

CVE-2023-6984

The PowerPack Addons for Elementor Free Widgets, Extensions and Templates plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.13. This is due to missing or incorrect nonce validation in the...

MAL-2024-25 Malicious code in airslate-navigation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e41b4f37c7cdc6ed1146786305e2b00c1eaf11b43ff145ff46dc6b797e98cfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Google Settles $5 Billion Privacy Lawsuit Over Tracking Users in 'Incognito Mode'

Google has agreed to settle a lawsuit filed in June 2020 that alleged that the company misled users by tracking their surfing activity who thought that their internet use remained private when using the "incognito" or "private" mode on web browsers. The class-action lawsuit sought at least $5...

Helping a banking fraud victim

A few months ago an elderly friend of a friend asked for some help. They had been scammed and had £10K stolen. Was there anything I could do to help? This wasn’t going to be a pleasant task: recovering monies stolen as a result of banking fraud is all but impossible. I was going to have to explai...

MAL-2024-8 Malicious code in @authentication-pages/vue-cli-prebuild (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3c92ef13745278b15d59dfa706f96df5f1c3bb0261c9471d3e56eaa1449059e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-32885

In display drm, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07780685; Issue ID: ALPS07780685...

S-CMS SQL Injection Vulnerability

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS China. A SQL injection vulnerability exists in S-CMS version 2.0build20220529-20231006 and earlier versions, which originates from a problem with the unknown function of /member/ad.php?action=ad...

MAL-2023-8772 Malicious code in chain00x (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c83ef376b2958042c056eb67747bc40dd5850c90e665e7eb769642be3974e70a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-50071

Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customersupport/ajax.php?action=savedepartment via id or name...

CVE-2023-51664

tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrar...

Command injection

tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrar...

CVE-2023-51664

The CVE refers to the GitHub Action tj-actions/changed-files. Before version 41.0.0, the action allowed command injection through changed filenames, enabling potential arbitrary code execution on the GitHub Runner and possible secret leakage. Affected component: tj-actions/changed-files (GitHub A...

CVE-2023-51664 tj-actions/changed-files command injection in output filenames

tj-actions/changed-files is a Github action to retrieve all files and directories. Prior to 41.0.0, the tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue may lead to arbitrar...

MAL-2023-8749 Malicious code in axio-https (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3df6da0e125618885a14db25ec3079b2defda4eaa1065e8b026826af6404f594 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-31875 · Github · Tj-Actions/Changed-Files

Name of the Vulnerable Software and Affected Versions: tj-actions/changed-files versions prior to 41.0.0 Description: The tj-actions/changed-files workflow allows for command injection in changed filenames, allowing an attacker to execute arbitrary code and potentially leak secrets. This issue ma...

CVE-2023-6155 Quiz Maker < 6.4.9.5 - Unauthenticated Email Address Disclosure

The Quiz Maker WordPress plugin before 6.4.9.5 does not adequately authorize the aysquizauthorusersearch AJAX action, allowing an unauthenticated attacker to perform a search for users of the system, ultimately leaking user email addresses...

VulnCheck KEV: CVE-2022-0656

The Web To Print Shop : uDraw WordPress plugin before 3.3.3 does not validate the url parameter in its udrawconverturltobase64 AJAX action available to both unauthenticated and authenticated users before using it in the filegetcontents function and returning its content base64 encoded...

CVE-2020-36769

The Widget Settings Importer/Exporter Plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the wpajaximportwidgetdataparameter AJAX action in versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...