5091 matches found
Malicious Package
Overview kfactionbypasser is a malicious package. It distributes Discord malware hosted on GitHub, that can steal important host information and credentials. Remediation Avoid using all malicious instances of the kfactionbypasser package. References - Injected Code Credit: Snyk Research Team...
PT-2023-12316 · Teradek · Teradek Sphere
Name of the Vulnerable Software and Affected Versions: Teradek Sphere all firmware versions Description: The issue allows remote attackers to run arbitrary code via the Friendly Name field in System Information Settings. This is a Cross Site Scripting XSS issue. The vendor states that the product...
CVE-2022-2546
The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...
CVE-2022-2546
The CVE-2022-2546 issue affects WordPress All-in-One WP Migration plugin < 7.63. The vulnerability arises from using the wrong content type and not properly escaping the ai1wm_export response, enabling an attacker to craft a request that, when submitted by a visitor, injects arbitrary HTML/Jav...
CVE-2022-2546 All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS
The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...
CVE-2022-2546 All-in-One WP Migration < 7.63 - Unauthenticated Reflected XSS
The All-in-One WP Migration WordPress plugin before 7.63 uses the wrong content type, and does not properly escape the response from the ai1wmexport AJAX action, allowing an attacker to craft a request that when submitted by any visitor will inject arbitrary html or javascript into the response...
WordPress Plugin All-in-One WP Migration 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
GHSA-2275-RPF5-XV8H is-http2 vulnerable to Improper Input Validation
All versions of the package is-http2 are vulnerable to Command Injection due to missing input sanitization or other checks, and sandboxes being employed to the isH2 function...
Malicious Package
Overview luciad is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...
Stack overflow
Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020. A specially-crafted network packet can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger these...
PT-2023-12672 · Smartctl · Smartctl
Name of the Vulnerable Software and Affected Versions: smartctl versions all Description: The issue is related to Command Injection via the info method due to improper input sanitization. This allows for potential exploitation. No information is provided about the estimated number of potentially...
The vulnerability of the Cisco Industrial Network Director software lies in its ability to access a static secret key, allowing an intruder to gain access to all controlled systems.
The vulnerability of the Cisco Industrial Network Director software package relates to the possibility of accessing a static secret key. Exploiting this vulnerability could allow an attacker to gain access to all controlled systems...
CVE-2022-4346
The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...
CVE-2021-43449
ONLYOFFICE all versions as of 2021-11-08 is vulnerable to Server-Side Request Forgery SSRF. The document editor service can be abused to read and serve arbitrary URLs as a document...
CVE-2022-4346 All In One WP Security & Firewall < 5.1.3 - Configuration Leak
The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...
CVE-2022-4346 All In One WP Security & Firewall < 5.1.3 - Configuration Leak
The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...
CVE-2022-4346
The CVE-2022-4346 issue affects the All-In-One Security (AIOS) WordPress plugin (versions prior to 5.1.3). The underlying problem is an information disclosure: plugin settings, including the email address, were leaked publicly. Public references and security feeds document an exposure vector tied...
WordPress plugin The All-In-One Security 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
Ascensio System ONLYOFFICE 访问控制错误漏洞
Ascensio System ONLYOFFICE is an office software from Ascensio System, Latvia. An Access Control Error vulnerability exists in all versions of ONLYOFFICE prior to 2021-11-08 that stems from being affected by incorrect access control. Authentication bypass in the document editor allows an attacker...
PT-2023-12453 · Unknown · Onlyoffice
Name of the Vulnerable Software and Affected Versions: ONLYOFFICE all versions as of 2021-11-08 Description: The issue allows for Server-Side Request Forgery SSRF, where the document editor service can be exploited to read and serve arbitrary URLs as a document. Recommendations: For all versions ...