Malicious code in your-dpd-rest-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57f29438d66f642d44c66209d9219a5bce9c31f2cdb3437e711193f13af28113 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7941 Malicious code in your-dpd-rest-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57f29438d66f642d44c66209d9219a5bce9c31f2cdb3437e711193f13af28113 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @dpdgroupuk/your-dpd-rest-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dc0b6ed54c73bb7b7cfbb33bfedad652cee9252913fd10dcc726d67cdea39f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

dpd-mlii.mfu.ac.th Cross Site Scripting vulnerability OBB-3355244

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2022-3999

The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable...

Cross site request forgery (csrf)

The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable...

CVE-2022-3999 WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion

The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable...

CVE-2022-3999 WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion

The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable...

CVE-2022-3999

Affected software: DPD Baltic Shipping WordPress plugin. Vulnerable: versions prior to 1.2.57, due to missing authorization and CSRF protection in an AJAX action. Impact: any authenticated user (e.g., subscriber) could delete arbitrary options, potentially rendering the blog unavailable. Remediat...

WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion

The plugin does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable. PoC Run the below command in the developer console of the web browser while being on t...

WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion

The plugin does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable. Run the below command in the developer console of the web browser while being on the...

WooCommerce Shipping - DPD baltic < 1.2.11 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. Put the following payload in the Name field of...

WooCommerce Shipping - DPD baltic < 1.2.11 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC Put the following payload in the Name field o...

WordPress WooCommerce Shipping - DPD baltic plugin <= 1.2.8 - Auth. Stored Cross-Site Scripting (XSS) vulnerability

Auth. Stored Cross-Site Scripting XSS vulnerability discovered by Lana Codes in WordPress WooCommerce Shipping - DPD baltic plugin versions = 1.2.8. Solution Update the WordPress DPD Baltic Shipping plugin to the latest available version at least 1.2.11...

Malicious code in dpd-returns-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6ef9bb6d12034b7105aa8e0bfc2ade917b80d7c6fa5f5aaa625cedbe7e3c3dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2582 Malicious code in dpd-returns-portal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6ef9bb6d12034b7105aa8e0bfc2ade917b80d7c6fa5f5aaa625cedbe7e3c3dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2581 Malicious code in dpd-cnf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e7d6a1334c371170cf7af7116db9cebbbde32ccdde72437b7e919a9675610c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dpd-cnf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e7d6a1334c371170cf7af7116db9cebbbde32ccdde72437b7e919a9675610c4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DPD package sniffing

TL;DR An unauthenticated API call was identified in DPD Group’s public API that could allow a user with a valid package ID to, with some basic OSINT, discover the package’s destination postcode and thus obtain all details about the package. DPD Group were prompt in the triage and resolution of th...

dpd.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-449074 Description| Value ---|--- Affected Website:| dpd.co.uk Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...