WordPress Google Maps Anywhere plugin <= 1.2.6.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Vinay Varma Mudunuri, Krishna Harsha Kondaveeti in WordPress Google Maps Anywhere plugin versions = 1.2.6.3. Solution Deactivate and delete. This plugin has been closed as of July 15, 2022 and is not available for download...

Google Maps Anywhere <= 1.2.6.3 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape any of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup PoC Put the following payload in any of the plugin...

CVE-2022-31528

The bonn-activity-maps/bamannotationtool repository through 2021-08-31 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2022-31528

The CVE-2022-31528 entry concerns the bonn-activity-maps/bam_annotation_tool repository. Concrete details from connected sources show a path traversal vulnerability caused by unsafe handling of file paths in Flask’s send_file function, affecting versions up to 2021-08-31. The issue enables an att...

Annotation Tool 路径遍历漏洞

Annotation Tool is a Bonn activity map annotation tool open sourced by bonn-activity-maps. 2021-08-31 and earlier versions of Annotation Tool are vulnerable to a path traversal vulnerability that stems from a failure of Flask's sendfile function to properly filter special elements in a resource o...

Malicious Package

Overview @uc-maps/test1 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious Package

Overview @uc-maps/geospatial is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

Malicious Package

Overview @uc-maps/boundaries-core.react is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Malicious Package

Overview @uc-maps/layer-select.react is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

Exploit for NULL Pointer Dereference in Linux Linux_Kernel

Proof of Concept Exploit Code for CVE-2022-23222 This is a POC...

WordPress plugin Inline Google Maps cross-site request forgery vulnerability

WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL. WordPress plugin Inline Google Maps 5.11 and earlier versions are vulnerable to cross-site request forgery, which stems from not...

MAL-2022-2829 Malicious code in eslint-plugin-yandex-maps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14666129d0fc309e24efbcdc0bd4595a45bbf3b02d9a031a0a29413961fb2cac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eslint-plugin-yandex-maps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14666129d0fc309e24efbcdc0bd4595a45bbf3b02d9a031a0a29413961fb2cac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xyz-maps-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 068b7cef9e2b8e7f9f23592b6f84bd995a7195e8c952d1f85cd8e18ca9b1d2e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7305 Malicious code in xyz-maps-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 068b7cef9e2b8e7f9f23592b6f84bd995a7195e8c952d1f85cd8e18ca9b1d2e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @eg-maps/commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 683771ccbf7865145f726b98e031ef733f7c549710df47bd019217e6373df1e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-227 Malicious code in @eg-maps/commons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 683771ccbf7865145f726b98e031ef733f7c549710df47bd019217e6373df1e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4480 Malicious code in maps-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77941a159908349eb82d90ae8105f74c66d5bfaeb4879e9e0f96bffcdd1b4b9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in maps-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77941a159908349eb82d90ae8105f74c66d5bfaeb4879e9e0f96bffcdd1b4b9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-677 Malicious code in @uc-maps/api.react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f409bbd4d44a1d019c99abc6d3f4c3fdb6caf61568a7a1235c25fe5ff3995c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...