Malicious code in @icbc-ltd/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92afc232f13b9d167073ab50c37956579f3bcbd5801bc586dca168230aeb215a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-343 Malicious code in @icbc-ltd/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92afc232f13b9d167073ab50c37956579f3bcbd5801bc586dca168230aeb215a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress WP Duplicate Page plugin <= 1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Sachin Bahl eSec Forte Technologies Pvt Ltd in WordPress WP Duplicate Page plugin versions = 1.2. Solution Update the WordPress WP Duplicate Page plugin to the latest available version at least 1.3...

Command Execution Vulnerability in the Operation and Maintenance Audit System of Beijing COSCO Kirin Technology Co. Ltd (CNVD-2022-53245)

COSCO KyLin Technology Co., Ltd. is a R&D-oriented software development company, the company's main products are COSCO KyLin Barrier Machine, KyLin SSL VPN, KyLin Dynamic Password System, KyLin Cloud Desktop and so on. Our main products are COSCO Kirin SSL VPN, Kirin Dynamic Password System, Kiri...

Ltd. has SQL injection vulnerability in the security management system of Centrin JingYun terminal

Centrin Jing Cloud Terminal Security Management System is an enterprise-level network anti-virus system developed by Beijing Centrin Link Information Technology Co. Ltd. There is a SQL injection vulnerability in the security management system of Centron View Cloud Terminal, which can be exploited...

File upload vulnerability in MCMS of Jiangxi Minsoft Technology Co. Ltd (CNVD-2022-44353)

MCMS is a java-based development of a lightweight open source content management system . Jiangxi Mingsoft Technology Co., Ltd MCMS file upload vulnerability, an attacker can use the vulnerability to obtain control of the server...

CVE-2022-27438

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...

Remote code execution

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...

CVE-2022-27438

Caphyon Ltd Advanced Installer 19.3 and earlier and many products that use the updater from Advanced Installer Advanced Updater are affected by a remote code execution vulnerability via the CustomDetection parameter in the update check function. To exploit this vulnerability, a user must start an...

CVE-2022-27438

CVE-2022-27438 affects Caphyon Advanced Installer 19.3 and earlier and products using the Advanced Updater. The root cause is a remote code execution vulnerability in the update check function via the CustomDetection parameter. Exploitation requires starting an affected installation to trigger th...

CVE-2022-30425

Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerability is exploited via a crafted POST request...

Command Execution Vulnerability in WoSmart Top Shop Mall System

Zhejiang WoSmith Information Technology Co., Ltd. is a technology company specializing in mobile Internet technology development. There is a command execution vulnerability in WoSmith's list store mall system, which can be exploited by an attacker to gain control of the server...

CVE-2022-30425

Tenda Technology Co.,Ltd HG6 3.3.0-210926 was discovered to contain a command injection vulnerability via the pingAddr and traceAddr parameters. This vulnerability is exploited via a crafted POST request...

CVE-2022-30425

Affected product : Tenda HG6 router (firmware/software version 3.3.0-210926, HG6). Vulnerability : OS command injection via HTTP POST parameters in the formPing/formPing6 and formTracert/formTracert6, exploiting unfiltered input in the pingAddr and traceAddr fields. Root cause : failure to proper...

JVN#13878856: Mobaoku-Auction & Flea Market App for iOS vulnerable to improper server certificate verification

Mobaoku-Auction & Flea Market App for iOS provided by DeNA Co., Ltd. is vulnerable to improper server certificate verification CWE-295. Impact A man-in-the-middle attack may allow an attacker to eavesdrop on an encrypted communication. Solution Update the application Update the application to the...

JVN#46241173: EC-CUBE plugin "Easy Blog for EC-CUBE4" vulnerable to cross-site request forgery

EC-CUBE plugin "Easy Blog for EC-CUBE4" provided by COREMOBILE Co. Ltd. contains a cross-site request forgery vulnerability CWE-352. Impact If a site administrator who is logging in to the management screen of EC-CUBE on which the plug-in is installed accesses a specially crafted page, a blog...

Command Execution Vulnerability in JingYun Terminal Security Management System of Beijing Centron Link Information Technology Co.

Ltd. was established in July 2016, by Beijing Qixingchen Information Security Technology Co., Ltd., Beijing Beixinyuan Software Co., Ltd., Beijing Zhengyong Information Technology Co. Beijing Centron Lead Information Technology Co., Ltd. Jing cloud terminal security management system there is a...

Command injection

Command injection vulnerability in Manual Ping Form Web UI in Shenzhen Ejoin Information Technology Co., Ltd. ACOM508/ACOM516/ACOM532 609-915-041-100-020 allows a remote attacker to inject arbitrary code via the field...

CVE-2022-23332

CVE-2022-23332 is a command-injection vulnerability in the Manual Ping Form (Web UI) of Shenzhen Ejoin Information Technology Co., Ltd. for ACOM508/ACOM516/ACOM532 devices (version 609-915-041-100-020). The flaw allows a remote attacker to inject arbitrary code via a field in the Web UI’s Manual ...

Unrestricted file upload

Beijing Runnier Network Technology Co., Ltd Open virtual simulation experiment teaching management platform software 2.0 has a file upload vulnerability, which can be exploited by an attacker to gain control of the server...