CVE-2023-0730

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajaxsavefolderorder function. This makes it possible for unauthenticated attackers to invoke this function via...

Internet Bug Bounty: Open Redirect Vulnerability in Action Pack

An open redirect vulnerability was discovered in Action Pack, specifically in the redirectto helper function. This vulnerability allowed for the possibility of an attacker to craft a URL that could bypass the protection against open redirects introduced in Rails 7.0. The vulnerability was fixed i...

CVE-2023-0728

The Wicked Folders plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.18.16. This is due to missing or incorrect nonce validation on the ajaxsavefolder function. This makes it possible for unauthenticated attackers to invoke this function via forg...

MAL-2023-884 Malicious code in thenamk3zg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52bcaf8a754f24d5679cb567cca3c9c6ab028ac369266cacf4ca6d4494f5c27b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-42291

NVIDIA GeForce Experience contains a vulnerability in the installer, where a user installing the NVIDIA GeForce Experience software may inadvertently delete data from a linked location, which may lead to data tampering. An attacker does not have explicit control over the exploitation of this...

PT-2023-16485 · WordPress · Interactive Geo Maps

Name of the Vulnerable Software and Affected Versions: Interactive Geo Maps plugin for WordPress versions up to, and including, 1.5.9 Description: The issue is related to Stored Cross-Site Scripting via the action content parameter due to insufficient input sanitization and output escaping on...

CVE-2023-20608

In display drm, there is a possible use after free due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07363599; Issue ID: ALPS07363599...

CVE-2022-4681

The Hide My WP WordPress plugin before 6.2.9 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...

MAL-2023-121 Malicious code in ban-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aecea46554ceaa591315411d0d3e279f9dab01878d3136b5f7a3e6e44974bb94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in action-destinations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96505de3d3aa2e8998dd55d2d3c5571986d30ba16c8bc9971c3f9e8348264ed9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-328 Malicious code in fc-account-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e2a2b9137afe6979e5b25e3e2aba4da1a9152feee7e21f1fc61c909273642d2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-858 Malicious code in testneb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c5bc4adbdc90c94de1d80650508a0952b81e7cac9c2d2307982fb42be7eea49 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress All-in-One WP Migration Plugin < 7.63 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:servmask:one-stopwpmigration"; ifdescription...

CVE-2022-38657 An open redirect to malicious sites affects HCL Leap

An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page...

CVE-2022-38657 An open redirect to malicious sites affects HCL Leap

An open redirect to malicious sites can occur when accessing the "Feedback" action on the manager page...

CVE-2022-38657

The CVE-2022-38657 issue is an open redirect vulnerability affecting HCL Leap (manager page Feedback action). Public records describe that an open redirect to malicious sites can occur when accessing the Feedback action, with various sources identifying this as an issue in the Leap platform. Root...

MAL-2023-197 Malicious code in codeceptjs-browserstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 803e944b4406063368c8940d7f34221d26b1855be2d200abb731f20d97def026 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mypy-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e1b919537a89780d36cd0352b5a2a78fb75def0b31c115111e26acb0c979c0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-613 Malicious code in mypy-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e1b919537a89780d36cd0352b5a2a78fb75def0b31c115111e26acb0c979c0d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-783 Malicious code in solc-0.8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cb2ef4de1156c7094d66ff9e85b4e9b17b04b11eb2348040a1f7c8756c7b0a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...