Malicious code in fca-imran-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 358afd8d601316f313a38fc5c4433ff8b13a1082ec2c05ea6c91464b62d5125f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress plugin FULL Customer 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

CVE-2024-54313: Path Traversal: '.../...//'

Path Traversal vulnerability in FULL. FULL Customer allows Path Traversal.This issue affects FULL Customer: from n/a through 3.1.25...

PT-2024-36195 · Full · Full

Name of the Vulnerable Software and Affected Versions: FULL Customer versions 3.1.25 and earlier Description: The issue is related to a Path Traversal vulnerability. This allows for unauthorized access to files and directories. The estimated number of potentially affected devices is not specified...

Malicious code in fake-emitter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41407456feff64ada241bb9174752b12b3533a3827629a708296e06c3379fa7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

[SECURITY] Fedora 41 Update: python3.9-3.9.21-1.fc41

Python 3.9 package for developers. This package exists to allow developers to test their code against an older version of Python. This is not a full Python stack and if you wish to run your applications with Python 3.9, see other distributions that support it, such as CentOS or RHEL or older Fedo...

WordPress Vimeography plugin <= 2.4.4 - Full Path Disclosure (FPD) vulnerability

Full Path Disclosure FPD vulnerability discovered by Fariq Fadillah Gusti Insani Patchstack Alliance in WordPress Plugin Vimeography versions = 2.4.4...

WordPress FULL – Cliente plugin <= 3.1.25 - Local File Inclusion vulnerability

Local File Inclusion vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin FULL Customer versions = 3.1.25...

Malicious code in lfs-au-website-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c1cede85f63ef726a200198c527060cd81e0506a726fc5ad92ce154a3873e99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jekyll-doxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc397fffef5e9f788df267304bc1d6a1889066148532360fd247d8852cc0050d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-54151

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions...

CVE-2024-54151 Directus allows unauthenticated access to WebSocket events and operations

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions...

CVE-2024-54151 Directus allows unauthenticated access to WebSocket events and operations

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions...

Directus allows unauthenticated access to WebSocket events and operations

Summary When setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions with full admin privileges. Details Accountability for unauthenticated WebSocket requests is set to null, which used to be "publi...

GHSA-849R-QRWJ-8RV4 Directus allows unauthenticated access to WebSocket events and operations

Summary When setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions with full admin privileges. Details Accountability for unauthenticated WebSocket requests is set to null, which used to be "publi...

Malicious code in electron_npm_deps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4fab50ae8be78e8043fb45e594ddc2011c78115201e0697bcdf80e50f785a40 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-54151: Exposure of Sensitive Information to an Unauthorized Actor

Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 11.0.0 and prior to version 11.3.0, when setting WEBSOCKETSGRAPHQLAUTH or WEBSOCKETSRESTAUTH to "public", an unauthenticated user is able to do any of the supported operations CRUD, subscriptions...

Malicious code in adminconsole (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88480db379ccb5378aada30388162f00d8033acb86b62e8d2e490533646c4a4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zkonmina (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a74c40ef671e2fb9d5956f1fd7f022e0dd1ca0f1da3602a687e9172cc4280fcc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in normal-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f2efb34b8082c086da6493f93ca16d2de070a218ff6cb8f2c32468ca268412f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...