CVE-2023-3122 GD Mail Queue <= 3.9.3 - Unauthenticated Stored Cross-Site Scripting via Email

The GD Mail Queue plugin for WordPress is vulnerable to Stored Cross-Site Scripting via email contents in versions up to, and including, 3.9.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages...

WordPress Plugin GD Mail Queue 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-23241 · WordPress · Gd Mail Queue

Name of the Vulnerable Software and Affected Versions: GD Mail Queue plugin for WordPress versions up to and including 3.9.3 Description: The issue arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages via emai...

Debian DSA-5424-1 : php7.4 - security update

The remote Debian 11 host has packages installed that are affected by a vulnerability as referenced in the dsa-5424 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The...

Debian DSA-5425-1 : php8.2 - security update

The remote Debian 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5425 advisory. It was discovered that PHP's implementation of SOAP HTTP Digest authentication performed insufficient error validation, which may result in a stack information leak or use...

EulerOS Virtualization 3.0.6.0 : php (EulerOS-SA-2023-2243)

According to the versions of the php packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - The zendstringextend function in Zend/zendstring.h in PHP through 7.1.5 does not prevent changes to string objects that result in a...

WordPress GD Mail Queue Plugin <= 3.9.3 is vulnerable to Cross Site Scripting (XSS)

Software GD Mail Queue Type Plugin Vulnerable versions = 3.9.3 Fixed in 4.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-3122 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 1e928c6cc270 Credits Alex Thomas Required privile...

Malicious code in gd-company-updates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c1253df2e743d9b41ff76588069c9ee739cc67b4ca244e95405d4b949bcdfb2b The OpenSSF Package Analysis project identified 'gd-company-updates' @ 14.999.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1185 Malicious code in gd-company-updates (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c1253df2e743d9b41ff76588069c9ee739cc67b4ca244e95405d4b949bcdfb2b The OpenSSF Package Analysis project identified 'gd-company-updates' @ 14.999.0 npm as malicious. It is considered malicious because: - The...

Oracle Linux 8 : php:7.4 (ELSA-2023-2903)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-2903 advisory. - CVE-2015-2331: integer overflow when processing ZIP archives 1204676,1204677 - fixes for CVE-2012-1162 and CVE-2012-1163 - fix: due to an integer...

Amazon Linux 2 : gd (ALAS-2023-2044)

The version of gd installed on the remote host is prior to 2.0.35-27. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2023-2044 advisory. DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is...

Important: gd

Issue Overview: DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position is "The GD2 image format is a proprietary image format of libgd. It has to be regarded as being obsolete, and should only be used for development and...

Security Bulletin: Vulnerabilities in php5 affect IBM BladeCenter Advanced Management Module (AMM)

Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in php5. Vulnerability Details Summary IBM BladeCenter Advanced Management Module AMM has addressed the following vulnerabilities in php5. Vulnerability Details CVEID: CVE-2016-6911 Description:...

Amazon Linux AMI : gd (ALAS-2023-1721)

The version of gd installed on the remote host is prior to 2.0.35-11.11. It is, therefore, affected by a vulnerability as referenced in the ALAS-2023-1721 advisory. DISPUTED gdImageGd2Ptr in gdgd2.c in the GD Graphics Library aka LibGD through 2.3.2 has a double free. NOTE: the vendor's position ...

Malicious Package

Overview gd-testtesttest is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious Package

Overview gd-config is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview gd-apply is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview gd-login is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious code in gd-login (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 190b8c40ae199e301f0ec2e1364caac0d49271c7fd8cc7ea7192502f06e2945c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gd-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 221b6a9aa3d4f9b660d09c76d266034543c6cfd6fbd0da1dfa564ec050c0a446 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...