Multiple Self-XSS Vulnerabilites

Description Multiple Self-XSS Vulnerabilities are triggered at multiple endpoints. http://localhost:8083/edit/server/ There is a bug in web/templates/pages/editserver.php file. Attacker can control $vtimezone. php ', theme: '', language: '', hasSmtpRelay: , remoteBackupEnabled: , backupType: '',...

Malicious code in puppeteer-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86dc3a8e94227c886be1f23f2acbcbfcf8e01dd2664461ea24aff9236351b195 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zara-mkt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 63035f09a78f784aa3cc30ea29d7a7508c1811c6f344d00b42e93338f2cb50c5 The OpenSSF Package Analysis project identified 'zara-mkt-core' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in visual_components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7289e2b3846c5d4eacbe709a4bd08a2e48688e587b810b9535c2275275dd2497 The OpenSSF Package Analysis project identified 'visualcomponents' @ 1.0.13 npm as malicious. It is considered malicious because: - The package...

PT-2023-23609 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.11 through 16.1.4 GitLab versions 16.2 through 16.2.4 GitLab versions 16.3 through 16.3.0 Description: An issue has been discovered in GitLab where an authenticated user could trigger a denial of service when importing or...

Malicious code in wallet-add-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f669adaac6e6303053b5a1d293a7250bd6a4f8e3c3fa52f941d1a1c4497955a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Update for Microsoft Visual Studio Code Cloudfoundry Manifest YML Support Extension (CVE-2022-31691)

The Microsoft Visual Studio Code Cloudfoundry Manifest YML Support Extension is version 1.39.0 or below. It is, therefore, affected by a remote code execution vulnerability. The extension uses the Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML...

Malicious code in twentytwenty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0b5cb94b4e758aaabd499e42ac5e149391b5f11597501e5df504661a2d633122 The OpenSSF Package Analysis project identified 'twentytwenty' @ 1.9.1 npm as malicious. It is considered malicious because: - The package...

CVE-2023-37379 Apache Airflow: Exposure of sensitive connection information, DOS and SSRF on "test connection" feature

Apache Airflow, in versions prior to 2.7.0, contains a security vulnerability that can be exploited by an authenticated user possessing Connection edit privileges. This vulnerability allows the user to access connection information and exploit the test connection feature by sending many requests,...

Malicious code in as-ui-deals (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59a46a45592f6c5043e6aa80e3fca0f987b6fad0cd0078499ea75823075847c1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in code-debug-codes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c78c334cc38295767013c4a8b7bd904fd09069e4b7f938183d8c247eefb27bec The OpenSSF Package Analysis project identified 'code-debug-codes' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1497 Malicious code in code-debug-codes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c78c334cc38295767013c4a8b7bd904fd09069e4b7f938183d8c247eefb27bec The OpenSSF Package Analysis project identified 'code-debug-codes' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in irviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2856bec7b72be87c4b6cc3f537871ee579bda13ad09ff85f5391ea1c0fdfe660 The OpenSSF Package Analysis project identified 'irviewer' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Command injection

A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this...

PT-2023-9151 · Unknown · Open-Xchange

Name of the Vulnerable Software and Affected Versions: Open-Xchange affected versions not specified Description: A component for parsing OXMF templates could be abused to execute arbitrary system commands that would be executed as the non-privileged runtime user. Users and attackers could run...

CVE-2023-3670

In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users...

CVE-2023-3670 Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting

In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users...

CVE-2023-3670 Codesys: Vulnerability in CODESYS Development System and CODESYS Scripting

In CODESYS Development System 3.5.9.0 to 3.5.17.0 and CODESYS Scripting 4.0.0.0 to 4.1.0.0 unsafe directory permissions would allow an attacker with local access to the workstation to place potentially harmful and disguised scripts that could be executed by legitimate users...

Malicious code in shein-bbl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis eda3e2bdbc515dead593a808202f565c6b47090d1b73b40cda908b6786eaf4ac The OpenSSF Package Analysis project identified 'shein-bbl' @ 0.1.4-beta npm as malicious. It is considered malicious because: - The package...

inDrive: Host Header Injection - internal.qa.delivery.indrive.com

A vulnerability was found where the Host header was not properly validated or escaped, allowing an attacker to inject arbitrary Host header values and manipulate server-side behavior. This could allow redirection to malicious sites for phishing...