WordPress Custom Post Limits Plugin <= 4.4.1 is vulnerable to Full Path Disclosure (FPD)

Software Custom Post Limits Type Plugin Vulnerable versions = 4.4.1 Fixed in N/A OWASP Top 10 A5: Security Misconfiguration Classification Full Path Disclosure FPD CVE CVE-2024-6544 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 71ab81c6724d Credits stealthcopter Required...

CVE-2024-6544: Exposure of Sensitive Information to an Unauthorized Actor

The Custom Post Limits plugin for WordPress is vulnerable to full path disclosure in all versions up to, and including, 4.4.1. This is due to the plugin utilizing bootstrap and leaving test files with displayerrors on. This makes it possible for unauthenticated attackers to retrieve the full path...

WordPress plugin Custom Post Limits 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. An information disclosure...

CVE-2024-39924: Incorrect Default Permissions

An issue was discovered in Vaultwarden formerly BitwardenRS 1.30.3. A vulnerability has been identified in the authentication and authorization process of the endpoint responsible for altering the metadata of an emergency access. It permits an attacker with granted emergency access to escalate...

Malicious code in quickread (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f630b92e6f63b18cbb46723f537d664a3aa6d2871a8d3add8834ec33f9d9e40f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in quickcolor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8187ba323a5e9587ea1b3fa14930b78a581a752826decd686ec9ceec9611f0b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in passports-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f07e6135ed2ddf89c87508abbc5a583e3ae22a8ae354dfd915c99471e01dbbd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8867 Malicious code in node-integration-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23d6de79c4bf861e69bfe8d180b460e32004ab2e37565da361ba8874d29c6a71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in perf-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed5faf9cf5e130e4cbc1696ada14520f753765e17645151d1fb90e27b680f09c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in publish-test-result-screenshot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf2cd13f851593ee5dc61c5c17c22a1efa0d43ec11f32023e7dfecfdd1c76adb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in create-auction-house (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c2211dcc1cfcd557e8c971ec03d126ef506517e91d0037f89be0bfb34265f0b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in color-print12345 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 73a80777a026505265f48975425e0d198263c4cce7bae5200201d7a10c7b329d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-23185

Very large headers can cause resource exhaustion when parsing message. The message-parser normally reads reasonably sized chunks of the message. However, when it feeds them to message-header-parser, it starts building up "fullvalue" buffer out of the smaller chunks. The fullvalue buffer has no si...

Bareos 授权问题漏洞

Bareos is a suite of open source data backup storage and recovery software from Bareos, Germany. An authorization issue vulnerability exists in Bareos that stems from an ACL check not applying to the full form when executing commands in bconsole...

MAL-2024-8855 Malicious code in gapuler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 135c461ca2038be20078852f46a2075decc45661e4f9493e152620b5e6479ece Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in evolution-ds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 319dd750e62370dfbc8bfdc0a3a2abcf5492d5a599b1a6c67a08ac126170df8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Big File Uploads plugin <= 2.1.2 - Authenticated (Author+) Full Path Disclosure vulnerability

Authenticated Author+ Full Path Disclosure vulnerability discovered by netc4t in WordPress Plugin Big File Uploads versions = 2.1.2...

WordPress Big File Uploads Plugin <= 2.1.2 is vulnerable to Full Path Disclosure (FPD)

Software Big File Uploads Type Plugin Vulnerable versions = 2.1.2 Fixed in 2.1.3 OWASP Top 10 A3: Sensitive Data Exposure Classification Full Path Disclosure FPD CVE CVE-2024-8538 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7d70a0318727 Credits netc4t Required privileg...

TOTOLINK AC1200 操作系统命令注入漏洞

The TOTOLINK AC1200 T8 is a wireless router that supports dual-band Wi-Fi at 1200Mbps rate for home or small office scenarios. The TOTOLINK AC1200 T8 suffers from an OS command injection vulnerability located in the /cgi-bin/cstecgi.cgi file, where the slaveIpList parameter is not validated with...

Malicious code in eslint-scope-util (npm)

The package contains the BeaverTail infostealer malware associated with DPRK threat actors. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c97eb42ab9ab02fd3a0e93acf449bb0fc75b1af462f6221cfca5d3b14588a0fb Any computer that has this package installed or running shoul...