Malicious code in algolia-places (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

hexo-theme-anzhiyu Cross-site Scripting vulnerability

Cross Site Scripting XSS vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function...

CVE-2024-25865

Cross Site Scripting XSS vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function...

Cross site scripting

Cross Site Scripting XSS vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function...

CVE-2024-25865

CVE-2024-25865 describes a Cross-Site Scripting (XSS) vulnerability in hexo-theme-anzhiyu v1.6.12, allowing remote attackers to execute arbitrary code via the algolia search function. The issue is documented across multiple sources (NVD, Red Hat, GHSA, OSV, CNNVD, etc.) with consistent descriptio...

CVE-2024-25865

Cross Site Scripting XSS vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function...

CVE-2024-25865

Cross Site Scripting XSS vulnerability in hexo-theme-anzhiyu v1.6.12, allows remote attackers to execute arbitrary code via the algolia search function...

hexo-theme-anzhiyu Security Vulnerabilities

hexo-theme-anzhiyu is a clean hexo theme by the personal developer of Chen Zhiwei anzhiyu-c. A security vulnerability exists in hexo-theme-anzhiyu v1.6.12, which stems from a cross-site scripting XSS vulnerability in the algolia search function...

Malicious Package

Overview dwolla-algolia-search is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Prototype Pollution

Overview algoliasearch-helper is a Helper for implementing advanced search features with algolia Affected versions of this package are vulnerable to Prototype Pollution in the merge function in merge.js, which allows constructor.prototype to be written even though doing so throws an error. In the...

Design/Logic Flaw

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...

CVE-2023-25164 Sensitive Information leak via Script File in TinaCMS

Tinacms is a Git-backed headless content management system with support for visual editing. Sites being built with @tinacms/cli = 1.0.0 && 1.0.9 which store sensitive values in the process.env variable are impacted. These values will be added in plaintext to the index.js file. If you're on a...

MAL-2023-297 Malicious code in dwolla-algolia-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93bb17b6d0a8a1b69ad18cd8ebd649cbb5d7e60f664ab2dfa212cb9f686ac801 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dwolla-algolia-search (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 93bb17b6d0a8a1b69ad18cd8ebd649cbb5d7e60f664ab2dfa212cb9f686ac801 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Algolia: Web Cache Deception vulnerability on algolia.com leads to personal information leakage

A web cache deception vulnerability was discovered on algolia.com, which could allow an attacker to trick a caching proxy into storing private information transmitted over the internet from an authenticated user. The attacker could then access the cached data, which may include personal and...

CVE-2021-23433

The package algoliasearch-helper before 3.6.2 are vulnerable to Prototype Pollution due to use of the merge function in src/SearchParameters/index.jsSearchParameters.parseNumbers without any protection against prototype properties. Note that this vulnerability is only exploitable if the...

PT-2021-15521

Name of the Vulnerable Software and Affected Versions algoliasearch-helper versions prior to 3.6.2 Description The issue arises from the use of the merge function in src/SearchParameters/index.js, specifically in the SearchParameters. parseNumbers function, without protection against prototype...

Algolia: Information disclosure -> 2fa bypass -> POST exploitation

Greetings! So i was testing algolia.com. Impressed to find out that there are mitigations in place to prevent POST exploitation such as : When 2fa is enabled we need "old password" to update following things : - To update the password - To disable the 2fa, etc might more more.... And we need 2fa...

Algolia: PHP-FPM status page disclosure

A page leaking debug information was publicly accessible...

Algolia: email verification bypass

An issue in the way email modification was handled during the email verification process allowed the creation of account with arbitrary email address, bypassing the email verification step. A logical flaw resulting in email verification bypass! :D...