CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

CVE-2024-48735

Directory Traversal in /SASStudio/sasexec/sessions/sessionID/workspace/InternalPath in SAS Studio 9.4 allows remote attacker to access internal files by manipulating default path during file download. NOTE: this is disputed by the vendor because these filesystem paths are allowed for authorized...

WordPress Get Quote For Woocommerce – Request A Quote For Woocommerce plugin <= 1.0.0 - Missing Authorization to Unauthenticated Quote PDF and CSV Download vulnerability

Missing Authorization to Unauthenticated Quote PDF and CSV Download vulnerability discovered by stehled in WordPress Plugin Get Quote For Woocommerce versions = 1.0.0...

MAL-2024-10292 Malicious code in opdistube (npm)

The package contains code to download and execute an infostealer payload...

Malicious code in celexkeygen (npm)

The package contains code to download and execute an infostealer payload. --- -= Per source details. Do not edit below this line.=-...

MAL-2024-10289 Malicious code in node-dlls (npm)

The package contains code to download and execute an infostealer payload. --- -= Per source details. Do not edit below this line.=-...

MAL-2024-10293 Malicious code in ro.dll (npm)

The package contains code to download and execute an infostealer payload. --- -= Per source details. Do not edit below this line.=-...

Malicious code in ro.dll (npm)

The package contains code to download and execute an infostealer payload. --- -= Per source details. Do not edit below this line.=-...

Malicious code in autoadv (npm)

The package contains code to download and execute an infostealer payload...

MAL-2024-10290 Malicious code in nodelement (npm)

The package contains code to download and execute an infostealer payload...

MAL-2024-10283 Malicious code in autoadv (npm)

The package contains code to download and execute an infostealer payload...

MAL-2024-10288 Malicious code in inject.dll (npm)

The package contains code to download and execute an infostealer payload. --- -= Per source details. Do not edit below this line.=-...

MAL-2024-10297 Malicious code in upgrade-roblox (npm)

The package contains code to download and execute an infostealer payload. --- -= Per source details. Do not edit below this line.=-...

MAL-2024-10294 Malicious code in robloxbootstrapper (npm)

The package contains code to download and execute an infostealer payload. --- -= Per source details. Do not edit below this line.=-...

WordPress Download Manager plugin < 3.3.00 - Contributor+ Stored XSS vulnerability

Contributor+ Stored XSS vulnerability discovered by Miguel Xavier Penha Neto in WordPress Plugin Download Manager versions 3.3.00...

CVE-2024-50508 WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through = 1.0.0...

CVE-2024-50508 WordPress Woocommerce Product Design plugin <= 1.0.0 - Arbitrary File Download vulnerability

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Chetan Khandla Woocommerce Product Design woo-product-design allows Path Traversal.This issue affects Woocommerce Product Design: from n/a through = 1.0.0...

CVE-2024-8444

The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting...

CVE-2024-8444

The Download Manager WordPress plugin before 3.3.00 doesn't sanitize some of it's shortcode parameters, leading to cross site scripting...

CVE-2024-10399

The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajaxsearchusers function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...