A SQL Injection in DuckDB via prompt can lead to RCE

Target Link Description sql = f""" SELECT ftsmainself.tablename.matchbm25self.nodeidcolumn, 'query' AS score, self.nodeidcolumn, self.textcolumn FROM self.tablename WHERE score IS NOT NULL ORDER BY score DESC LIMIT self.similaritytopk; """ The duckdbretriever performs "search using string" and...

Malicious code in undc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 96fc2e54b7c5d1c75212401bd2bb8440d40396e7baa89fc24b099cf8b139ba8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cfc-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 80e9bcf726b0cddf43089f7e5225471ba86fc21687c8987ec61276e9196dd994 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10948 Malicious code in thre-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4823222bd132c06ad184ec3e59942da59e35bf3ea088248a65305f89c0f1716 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tehter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a9947da85637a8b657c770fb0b61ce650c78b0683fab7f45fe3c41a9c26ca6fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in crypto-puch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac46e66a58a4b83fff27b66b7372f575870fe1abb4ae286e8e1c46ba2109af19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in web3bz (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb56e7431dc7049a19b5bed49044537ebd1157862a07e796bba3f4978f6c2c73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethtok (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b0f832fd0cdd6a58d023c764a4c24d072b82b8a5a16a069df3f271dd51ace5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ethcrypro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba9c04349ef6d36952c840a64414c794718cfd5fddd4f2c21355423bd6d36f63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in imon-media-downloader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3e79b6d6a40bed6caf15c5c2efc6da41d06f25fb082db4b3d3964112a091874 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10934 Malicious code in imon-media-downloader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3e79b6d6a40bed6caf15c5c2efc6da41d06f25fb082db4b3d3964112a091874 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in delta-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4a63f8d77e78e8b2cbc3bc3bfa80ee50373c5e9eb8cd9962c51a4a0ebec4b7cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rootkitfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f464c06e5146e96a9feed234e30390194912e24838433cad3daab70ecb350b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in plaid-tiny-quickstart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f6583cf366a5d9b2b4b3e8aaf4960a74b8fcc1224d6d862a5947ee56570dc252 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

UBUNTU-CVE-2024-11234

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests...

CVE-2024-11265

The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.3. This is due to returning image upload error messages with full path information. This makes it possible for authenticated...

CVE-2024-11265 Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosure

The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.3. This is due to returning image upload error messages with full path information. This makes it possible for authenticated...

CVE-2024-11265

CVE-2024-11265 affects the WordPress plugin WP Maximum Upload File Size | Increase Execution Time. All versions

CVE-2024-11265 Wp Maximum Upload File Size <= 1.1.3 - Authenticated (Author+) Full Path Disclosure

The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.3. This is due to returning image upload error messages with full path information. This makes it possible for authenticated...

CVE-2024-11265: Exposure of Sensitive Information to an Unauthorized Actor

The Increase Maximum Upload File Size | Increase Execution Time plugin for WordPress is vulnerable to Full Path Disclosure in all versions up to, and including, 1.1.3. This is due to returning image upload error messages with full path information. This makes it possible for authenticated...