MAL-2024-11060 Malicious code in opendevin-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77cef774221fcc201d7233921a587ac24de3a810c28e006c75513c79b54b9999 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10981 Malicious code in isc-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b71aad1132c126b880f7eefa52b380c3f11a2ec269e036e37e8755ddb3caf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in isc-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96b71aad1132c126b880f7eefa52b380c3f11a2ec269e036e37e8755ddb3caf6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Flowise OverrideConfig security vulnerability

Impact Flowise allows developers to inject configuration into the Chainflow during execution through the overrideConfig option. This is supported in both the frontend web integration and the backend Prediction API. This has a range of fundamental issues that are a major security vulnerability...

CVE-2024-48288

TP-Link TL-IPC42C V4.0202112271.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend...

CVE-2024-48288

TP-Link TL-IPC42C V4.0202112271.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend...

CVE-2024-48288

CVE-2024-48288 affects the TP-LINK TL-IPC42C device with firmware V4.0_20211227_1.0.16. The root cause is the lack of proper verification of malicious code on both the frontend and backend, leading to a command injection vulnerability. The entry assigns a high severity (CVSS 3.1 base score 8.0) a...

Nextcloud 信息泄露漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. Nextcloud suffers from an information disclosure vulnerability that stems from the fact that after storing "global credentials" on the server, the API returns...

Malicious code in oms-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 096fa8375c3d3d18ad7f109d5bcc12864480bd78ba8892401bc853554469accc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10763 Malicious code in oms-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 096fa8375c3d3d18ad7f109d5bcc12864480bd78ba8892401bc853554469accc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BIT-MATTERMOST-2024-46872

Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1, 9.5.x = 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks...

CVE-2024-50810

hopetree izone lts c011b48 contains a Cross Site Scripting XSS vulnerability in the article comment function. In \apps\comment\views.py, AddCommintView does not securely filter user input and renders it directly to the frontend page through templates...

CVE-2024-50810

hopetree izone lts c011b48 contains a Cross Site Scripting XSS vulnerability in the article comment function. In \apps\comment\views.py, AddCommintView does not securely filter user input and renders it directly to the frontend page through templates...

WordPress Post From Frontend plugin <= 1.0.0 - Post Deletion via CSRF vulnerability

Post Deletion via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin Post From Frontend versions = 1.0.0...

CVE-2024-9689

The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack...

CVE-2024-9689 Post From Frontend <= 1.0.0 - Post Deletion via CSRF

The Post From Frontend WordPress plugin through 1.0.0 does not have CSRF check when deleting posts, which could allow attackers to make logged in admin perform such action via a CSRF attack...

WordPress Post From Frontend Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Post From Frontend Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-9689 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3efb0a9a0186 Credits Bob Matyas Required...

GHSA-762G-9P7F-MRWW Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery

Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1, 9.5.x = 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks...

Mattermost Server Path Traversal vulnerability that leads to Cross-Site Request Forgery

Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1, 9.5.x = 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks...

CVE-2024-46872 Client-Side Path Traversal Leading to CSRF in Playbooks

Mattermost versions 9.10.x = 9.10.2, 9.11.x = 9.11.1, 9.5.x = 9.5.9 fail to sanitize user inputs in the frontend that are used for redirection which allows for a one-click client-side path traversal that is leading to CSRF in Playbooks...