27 matches found
Malware in @arv-bedrock/auth-admin
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
EUVD-2023-35115
Malicious code in bioql PyPI...
CVE-2023-46192
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Internet Marketing Ninjas Internal Link Building plugin = 1.2.3 versions...
CVE-2023-40604
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Jes Madsen Cookies by JM plugin = 1.0 versions...
CVE-2023-25042
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Liam Gladdy Storm Consultancy oAuth Twitter Feed for Developers plugin = 2.3.0 versions...
CVE-2023-30477
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Essitco AFFILIATE Solution plugin = 1.0 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin = 2.0.0 versions...
CVE-2023-23829
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Pierre JEHAN Owl Carousel plugin = 0.5.3 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in RVOLA WP Original Media Path plugin = 2.4.0 versions...
CVE-2023-25716
Auth admin+ Stored Cross-Site Scripting XSS vulnerability in gqevu6bsiz Announce from the Dashboard plugin = 1.5.1 versions...
OLIMPOKS Cross-Site Scripting Vulnerability
OLIMPOKS is a mobile device application for vocational training from olimpoks Russia. The application offers provides the opportunity to conduct training in industrial safety certified areas approved by Rostekhnadzor, labor protection, labor protection, civil defense and emergency situations on...
CVE-2020-16270
OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of...
CVE-2020-16270: Improper Neutralization of Input During Web Page Generation
OLIMPOKS under 3.3.39 allows Auth/Admin ErrorMessage XSS. Remote Attacker can use discovered vulnerability to inject malicious JavaScript payload to victim’s browsers in context of vulnerable applications. Executed code can be used to steal administrator’s cookies, influence HTML content of...
CVE-2020-14072: Improper Neutralization of Special Elements used in an OS Command
An issue was discovered in MK-AUTH 19.01. It allows command execution as root via shell metacharacters to /auth admin scripts...
PT-2020-13877
Name of the Vulnerable Software and Affected Versions MK-AUTH version 19.01 Description An issue in MK-AUTH allows command execution as root via shell metacharacters to /auth admin scripts. Recommendations For MK-AUTH version 19.01, consider restricting access to the /auth admin scripts as a...
CVE-2019-17431
An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...
PT-2019-15152
Name of the Vulnerable Software and Affected Versions fastadmin version 1.0.0.20190705 beta Description An issue was discovered in the software, specifically a CSRF vulnerability in the public/index.php/admin/auth/admin/add endpoint. Recommendations For fastadmin version 1.0.0.20190705 beta, as a...
CVE-2019-17431: Cross-Site Request Forgery (CSRF)
An issue was discovered in fastadmin 1.0.0.20190705beta. There is a public/index.php/admin/auth/admin/add CSRF vulnerability...
PT-2019-12166
Name of the Vulnerable Software and Affected Versions FastAdmin version 1.0.0.20190111 beta Description The issue allows for a CSRF attack to add a new admin user via the "admin/auth/admin/add?dialog=1" API endpoint. Recommendations For FastAdmin version 1.0.0.20190111 beta, as a temporary...