15125 matches found
MAL-2023-287 Malicious code in dpcf-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eff0ca3f36919d30bca5c57b0c42fd6bb21fe6d7bf5370806a538d228a691f87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-4553
The FL3R FeelBox WordPress plugin through 8.1 does not have CSRF check when updating reseting moods which could allow attackers to make logged in admins perform such action via a CSRF attack and delete the lydlposts & lydlpoststimestamp DB tables...
MAL-2023-423 Malicious code in fca-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 485827dec64675d8b8c4a64d0bf306ead2d7150e75029c3eabde32bf47800999 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-321 Malicious code in express-http-langdetect (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5c2e7abc09e3d84a919cf1e1214a8510e0ebb9084e43566dd531dfeb53803e36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-990 Malicious code in yandex-sendlinksms (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 33f280c3a000e1320bbd63fa8405b2dce27f6e488ae3557bb02a19394f76bdc5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-551 Malicious code in karma-wait-for-load (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4363de6912d277a4595653035e6e7dda06aae7a365147d88a2a349314e6f3f15 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-754 Malicious code in salmonpy (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fb81d0023923be1f52d516b2883a6869b118ff50c3d8fa4b69026f4e4c34a8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-542 Malicious code in juggler-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aca17bc321b94da5537d4f51328168ed92e4eb16b3f7cab7a2427930300496c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-316 Malicious code in eumetcast-gluing (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6391b29450cc3e689c0e17776ac6701e120bc2a577cf7d8d50e4d096a551514a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2023-0555
CVE-2023-0555 affects the WordPress plugin Quick Restaurant Menu (versions ≤ 2.0.2). The vulnerability is an authorization bypass in AJAX actions due to a missing capability check, allowing authenticated users with subscriber rights and above to invoke administrator‑level functions such as creati...
CVE-2023-0550 Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference
The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu...
PT-2023-16355 · WordPress · Quick Restaurant Menu
Name of the Vulnerable Software and Affected Versions: Quick Restaurant Menu plugin for WordPress versions up to, and including, 2.0.2 Description: The issue arises from Insecure Direct Object Reference, where the plugin fails to verify the post ID provided to the AJAX action during menu item...
Intuitive Custom Post Order < 3.1.4 - Arbitrary Menu Order Update via CSRF
The plugin lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack PoC...
CVE-2022-4383
The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
Sql injection
The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
CVE-2022-4383 CBX Petition for WordPress <= 1.0.3 - Unauthenticated SQLi
The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection...
PT-2023-14368 · WordPress · Cbx Petition
Name of the Vulnerable Software and Affected Versions: CBX Petition for WordPress plugin versions 1.0.3 and earlier Description: The issue arises from the plugin's failure to properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticate...
cbq_classify in net/sched/sch_cbq.c in the Linux kernel through 6.1.4 allows attackers to cause a denial of service (slab-out-of-bounds read) because of type confusion (non-negative numbers can sometimes indicate a TC_ACT_SHOT condition rather than valid classification results).
...
CVE-2023-22726
Summary: CVE-2023-22726 affects the act project (local GitHub Actions runner). The artifact server does not sanitize path inputs, enabling path traversal via user-controlled paths on both the /upload and /artifact endpoints, which can lead to arbitrary file download and potential overwrites on th...