GHSA-J88V-2CHJ-QFWX vulnerabilities

Vulnerabilities for packages: amass, hydra, grafana, sftpgo-plugin-eventstore, step-issuer, seaweedfs, k3s, spqr, steampipe, azure-service-operator, telegraf, jitsucom-bulker, opentelemetry-collector-contrib, dapr, certificate-transparency, cloudprober, wal-g, timescaledb-parallel-copy, gitness,...

CVE-2025-14053

The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

CVE-2025-14053 Travel Bucket List <= 0.5.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The Wish To Go plugin for WordPress is vulnerable to Stored Cross-Site Scripting via shortcode attributes in all versions up to, and including, 0.5.2 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with...

EUVD-2024-31677

Malicious code in bioql PyPI...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via improper sanitization of parameters in the smart.disk.get process. An attacker can inject arbitrary arguments into the smartctl command by supplying crafted input, potentially leading to the exposure of...

CVE-2024-3071

The ACF On-The-Go plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the acfgupdatefields function in all versions up to, and including, 1.0.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to...

CVE-2024-3071

CVE-2024-3071 affects the ACF On-The-Go plugin for WordPress. The issue is a missing capability check in acfg_update_fields(), making authenticated users with subscriber level access and above able to modify arbitrary post titles, descriptions, and ACF values in all versions up to 1.0.1. Publicly...

WordPress ACF On-The-Go plugin <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Content Update vulnerability discovered by Francesco Carlucci in WordPress Plugin ACF On-The-Go versions = 1.0.1...

CVE-2022-40764

A flaw was found in the snyk package. Affected versions of this package are vulnerable to Command Injection via the snyk-go-plugin which is used by the Snyk CLI tool...

Command Injection

snyk-go-plugin is vulnerable to command injection. The vulnerability exists in execute function of sub-process.js because shell for child processes is not properly disabled which allows an attacker to run arbitrary commands on the host system...

@adobe/git-server (>=0.9.18 <=1.0.5), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293 <=6.1.0) +37 more potentially affected by CVE-2022-40764 via snyk-go-plugin (>=1.10.0 <=1.17.0)

snyk-go-plugin NPM version =1.10.0, =0.9.18, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =3.2.4, =0.0.2, =0.0.7, =0.2.0, =0.2.8 and more Source cves: CVE-2022-40764 Source advisory: OSV:GHSA-HPQJ-7CJ6-HFJ8...

GHSA-HPQJ-7CJ6-HFJ8 Snyk CLI affected by Command Injection vulnerability

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...

CVE-2022-40764

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...

CVE-2022-40764

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...

CVE-2022-40764

CVE-2022-40764 affects Snyk CLI and related IDE plugins; before 1.996.0, it allowed arbitrary command execution, potentially via viewing untrusted files in VS Code. The original demonstration involved shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1 and...

CVE-2022-40764

Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in...

PT-2022-25524 · Snyk +1 · Snyk-Go-Plugin +5

Name of the Vulnerable Software and Affected Versions: Snyk CLI versions prior to 1.996.0 snyk-go-plugin versions prior to 1.19.1 Snyk TeamCity plugin versions prior to 20220930.142957 Description: The issue allows for arbitrary command execution, affecting Snyk IDE plugins and the snyk npm...