Transposh WordPress Translation 1.0.7 Cross Site Scripting

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Cross-Site Scripting CWE-79 Date found: 2021-08-19 Date published:...

PT-2022-9504 · WordPress +1 · Transposh Wordpress Translation Plugin +1

Name of the Vulnerable Software and Affected Versions: Transposh WordPress Translation plugin versions prior to 1.0.8 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the a parameter is not properly sanitised and escaped via an AJAX action. This...

Transposh WordPress Translation 1.0.8.1 Information Disclosure

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Exposure of Sensitive Information to an Unauthorized Actor CWE-200...

PT-2022-17535 · WordPress · Transposh Wordpress Translation Plugin

Name of the Vulnerable Software and Affected Versions: Transposh WordPress Translation plugin versions 1.0.8 and earlier Description: The issue allows access to sensitive actions, such as tp reset, under the Utilities tab, accessible via the /wp-admin/admin.php?page=tp utils endpoint. This...

Transposh WordPress Translation 1.0.8.1 Remote Code Execution

RCE Security Advisory https://www.rcesecurity.com 1. ADVISORY INFORMATION ======================= Product: Transposh WordPress Translation Vendor URL: https://wordpress.org/plugins/transposh-translation-filter-for-wordpress/ Type: Reliance on File Name or Extension of Externally-Supplied File...

WordPress plugin Transposh WordPress Translation 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2022-16766 · WordPress · Transposh Wordpress Translation Plugin

Name of the Vulnerable Software and Affected Versions: Transposh WordPress Translation plugin versions up to, and including, 1.0.8.1 Description: The issue is related to insufficient permissions checking on the 'tp history' AJAX action and insufficient restriction on the data returned in the...

CVE-2021-33371

A stored cross-site scripting XSS vulnerability in /navbaraction.php of Student Management System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat box...

PT-2022-9505 · WordPress · Transposh Wordpress Translation Plugin

Name of the Vulnerable Software and Affected Versions: Transposh WordPress Translation plugin versions prior to 1.0.8 Description: The issue is related to Stored Cross-Site Scripting. It occurs because the tk0 parameter from the tp translation AJAX action is not properly sanitized and escaped. Th...

PT-2022-16758

Name of the Vulnerable Software and Affected Versions Transposh WordPress Translation plugin versions up to, and including, 1.0.8.1 Description The issue is due to insufficient permissions checking on the 'tp translation' AJAX action and default settings, making it possible for unauthenticated...

T-Mobile agrees to pay customers $350 million in settlement over data breach

T-Mobile has agreed to pay $350 million to settle class action claims related to a 2021 cyberattack which impacted around 80 million US residents. Under the proposed settlement, T-Mobile would also commit to an aggregate incremental spend of $150 million for data security and related technology i...

PT-2022-10231 · Unknown · Student Management System

Name of the Vulnerable Software and Affected Versions: Student Management System version 1.0 Description: A stored cross-site scripting XSS issue in the "/nav bar action.php" API endpoint allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Chat box...

Student Management System 跨站脚本漏洞

Student Management System is a simple web-based student management software by the individual developer of Sk.Amir Hamza, Bangladesh. A security vulnerability exists in Student Management System version v1.0, which originates in navbaraction.php and allows attackers to execute arbitrary web scrip...

MAL-2022-2227 Malicious code in crashtravel-utilities (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44aa7d15a070ddfa4aebbe8a9c5a5e0c4951aeb0e9f327fe54446cddb14e4447 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6616 Malicious code in totaralms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05c9db01a67113b6a65bda9e61a061e87b78052c4c25c020444d03f2f88d892c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4546 Malicious code in melar-dev-site (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e6525cad3c4d1bf0fc67eb122a33e6498564f679ce593c6392b9fb0d24500fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5141 Malicious code in ot-performance (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f95260b8471bef6c94e381a82e48e888ae8a72f504b3a2e72b0890dde5242a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5140 Malicious code in ot-pausedetector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c29b4ba669bb741f074eb27f5c671dbe0f9e7376cda6b3f855fb2849338f5f18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6326 Malicious code in stringjs_lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 408657b4589508928485b1c6cb47eb32fe5964986aaa380196f80f7792356f1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5157 Malicious code in ovhcatalogs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a4c20f0f4b5fac102c14b23949dd32344d1c609ab0d5442a83f4fa098379261 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...