Malicious code in sap-ajax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5043f3d8029ebc47b9d5821a8d6d91c5a4659eb1d53a1bfd4fbbe2cfa1d9cf59 The OpenSSF Package Analysis project identified 'sap-ajax' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7528 Malicious code in sap-ajax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5043f3d8029ebc47b9d5821a8d6d91c5a4659eb1d53a1bfd4fbbe2cfa1d9cf59 The OpenSSF Package Analysis project identified 'sap-ajax' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

phpLDAPadmin Environmental Issues Vulnerabilities

PhpLdapAdmin is a web-based LDAP client from the individual developer of PhpLdapAdmin, which is primarily used to manage LDAP servers. An environmental issue vulnerability exists in phpLDAPadmin, which stems from an http request smuggling vulnerability in the makeHttpRequest function in...

UBUNTU-CVE-2024-37148

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37148 GLPI allows account takeover via SQL Injection in AJAX scripts

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

CVE-2024-37148

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

WordPress YITH WooCommerce Ajax Product Filter plugin <= 5.1.0 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Rafie Muhammad Patchstack in WordPress Plugin YITH WooCommerce Ajax Product Filter versions = 5.1.0...

CVE-2024-6411

The ProfileGrid – User Profiles, Groups and Communities plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 5.8.9. This is due to a lack of validation on user-supplied data in the 'pmuploadimage' AJAX action. This makes it possible for authenticated...

CVE-2024-6411

CVE-2024-6411 – ProfileGrid WordPress plugin : Privilege escalation in ProfileGrid – User Profiles, Groups and Communities was caused by lack of validation on the pm_upload_image AJAX action, allowing authenticated users with Subscriber+ access to elevate from a user to Administrator. Affected ve...

CVE-2024-37148: Improper Neutralization of Special Elements used in an SQL Command

GLPI is an open-source asset and IT management software package that provides ITIL Service Desk features, licenses tracking and software auditing. An authenticated user can exploit a SQL injection vulnerability in some AJAX scripts to alter another user account data and take control of it. Upgrad...

WordPress YITH WooCommerce Ajax Product Filter Plugin <= 5.1.0 is vulnerable to Cross Site Scripting (XSS)

Software YITH WooCommerce Ajax Product Filter Type Plugin Vulnerable versions = 5.1.0 Fixed in 5.2.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37943 Patch priority Medium CVSS severity Medium 5.8 Developer YITH PSID e8d179cee8c5 Credits Rafie Muhammad...

WordPress Just Custom Fields plugin <= 3.3.2 - Missing Authorization via AJAX actions vulnerability

Missing Authorization via AJAX actions vulnerability discovered by Francesco Carlucci in WordPress Plugin Just Custom Fields versions = 3.3.2...

WordPress Pricing Table plugin <= 2.0.1 - Cross-Site Request Forgery via ajax() vulnerability

Cross-Site Request Forgery via ajax vulnerability discovered by Benedictus Jovan aillesiM in WordPress Plugin Pricing Table versions = 2.0.1...

CVE-2024-6168

The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on several AJAX function. This makes it possible for unauthenticated attackers to invoke this functionality...

CVE-2024-5856

The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cirdeleteimage AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-4102

CVE-2024-4102 affects the Pricing Table plugin for WordPress. The root cause is a missing capability check in the ajax() function across versions up to and including 2.0.1, enabling authenticated attackers with subscriber-level access or higher to perform unauthorized actions such as editing pric...

CVE-2024-6168

CVE-2024-6168 refers to a CSRF vulnerability in the WordPress plugin Just Custom Fields, affecting all versions up to 3.3.2. The issue arises from missing or incorrect nonce validation on several AJAX functions, allowing unauthenticated attackers to trick an admin into performing admin actions. C...

CVE-2024-6168 Just Custom Fields <= 3.3.2 - Cross-Site Request Forgery via AJAX actions

The Just Custom Fields plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.3.2. This is due to missing or incorrect nonce validation on several AJAX function. This makes it possible for unauthenticated attackers to invoke this functionality...

CVE-2024-5856 Comment Images Reloaded <= 2.2.1 - Authenticated (Subscriber+) Arbitrary Media Deletion

The Comment Images Reloaded plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the cirdeleteimage AJAX action in all versions up to, and including, 2.2.1. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...