MAL-2022-2127 Malicious code in commons-ebay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7fca6c21af828f60fe97221a1964dd96fdfa94550187dd44fb09f7201f4d34f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5111 Malicious code in optimizer-plugin-inc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07b2794871339a2d8424d71ca9e8e0514ee68eda9532a9b9877de950becac68a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3552 Malicious code in hackmebankdkorrrevshell24h (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e55369120f912305ee693cd56b0eaecb1bb6df8c81871fc6e4e2ef2dfbd4411 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-25456 · Nikon · Nikon Nis-Elements Viewer

Name of the Vulnerable Software and Affected Versions: NIKON NIS-Elements Viewer version 1.2100.1483.0 Description: This issue allows remote attackers to execute arbitrary code on affected installations. User interaction is required, where the target must visit a malicious page or open a maliciou...

MAL-2022-3897 Malicious code in internallib_v340 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43570bd043aa581a3eeb3e0fa059e89cbdd9eb7be6e3e3c531c90f5d71dca94b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3907 Malicious code in internallib_v762 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dc5af611da7b52b99c0b71ac23e9409e4d106a69db6adbe56f72f0324a8cc52 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3913 Malicious code in internallib_v956 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8758f5377977e83ca398a91500b91301ec3c858b471af102017263dc84a5d1bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1724 Malicious code in builtin-pages-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3be644f30528e61fadc22a9526bbd5dc5460dedd27a297fe25b70ede89657a38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-23864 · Cuppacms · Cuppacms

Name of the Vulnerable Software and Affected Versions: CuppaCMS version 1.0 Description: The issue allows an authenticated user to execute remote code, providing control over certain parameters. Specifically, the /api/index.php API endpoint is affected, where an attacker can manipulate the action...

PT-2022-5084 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions 16.4.2 and earlier Adobe InDesign versions 17.3 and earlier Description: The issue is related to an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this...

Soledad < 8.2.5 - Reflected Cross-site Scripting

The theme does not sanitise the id,datafiltertype,... parameters in its pencimoreslistpostajax AJAX action, leading to a Reflected Cross-Site Scripting XSS vulnerability. PoC A threat actor can collect the nonce value on the main webpage by searching for it on the ajaxvarmore call: var ajaxvarmor...

MAL-2022-4894 Malicious code in node_resolve_index_4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c8be7ea03bc81bcad9f6fe805739562d98d955154ff91cd7d75255868f01ac9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2022-24320 · Unknown · Interview Management System

Name of the Vulnerable Software and Affected Versions: Interview Management System version 1.0 Description: The issue is related to a SQL injection vulnerability. It can be exploited via the /interview/delete.php component, specifically through the action and id parameters. Recommendations: For...

MAL-2022-7221 Malicious code in workbox-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8933e331d7e07ec6d6389f4a473479e2d306032d9d3b394d9243d7268c811270 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5131 Malicious code in osm-compare (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49b0e14451d493548f05cf4702c97fdd2f47e287d8801919e229430730b3d5f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5184 Malicious code in package-watcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware baa4cb3784d3ba6aafd1300c8861741e31526e2a3653564bc354e96cef74314c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EUVD-2022-34722

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tptranslation' AJAX action and default settings which makes it possib...

CVE-2022-2462

The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tphistory' AJAX action and insufficient restriction on the data...

CVE-2022-2462

The Transposh WordPress Translation plugin for WordPress is vulnerable to sensitive information disclosure to unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tphistory' AJAX action and insufficient restriction on the data...

CVE-2022-2461

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.8.1. This is due to insufficient permissions checking on the 'tptranslation' AJAX action and default settings which makes it possib...