reCAPTCHA Jetpack <= 0.2.2 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged-in admin add Stored XSS payloads via a CSRF attack. This requires Jetpack to be installed and to have a page/post with a Jetpack Contact Form...

VikBooking < 1.6.8 - Broken Access Control

Description The plugin's access control mechanism fails to properly restrict access to its settings, permitting any users that can access a menu to manipulate requests and perform unauthorized actions such as editing, renaming or deleting categories for example despite initial settings prohibitin...

reCAPTCHA Jetpack <= 0.2.2 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack Have an admin open an HTML page containing:...

Save as PDF < 3.2.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. On the "Settings Save as PDF Basic...

Ungallery <= 2.2.4 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Make a logged in admin open an HTML file containing the following: /" alert2' Save Changes...

DEBIAN-CVE-2024-26857

In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneverx syzbot triggered a bug in geneverx 1 Issue is similar to the one I fixed in commit 8d975c15c0cd "ip6tunnel: make sure to pull inner header in ip6tnlrcv" We have to save...

UBUNTU-CVE-2024-26857

In the Linux kernel, the following vulnerability has been resolved: geneve: make sure to pull inner header in geneverx syzbot triggered a bug in geneverx 1 Issue is similar to the one I fixed in commit 8d975c15c0cd "ip6tunnel: make sure to pull inner header in ip6tnlrcv" We have to save...

UBUNTU-CVE-2024-26882

In the Linux kernel, the following vulnerability has been resolved: net: iptunnel: make sure to pull inner header in iptunnelrcv Apply the same fix than ones found in : 8d975c15c0cd "ip6tunnel: make sure to pull inner header in ip6tnlrcv" 1ca1ba465e55 "geneve: make sure to pull inner header in...

Malicious code in trip-component-platform-online-header (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6902c9afc31fa0c3a2b8cc9970a33d7a27356e2171646b06e01e383655efea51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in trip-component-platform-online-prepermission-popup (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e7792da9bcfb9756c78247a525424f0782b412e24f2479452b818867cc71096 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @lbnqduy11805/stunning-octo-parakeet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c80f02945652dedbbc63973a876fbc73f9aae08b5c6760a072e8e9a994954cf9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in shuaishuai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20d1913d5bf067f2ae6c33f0d8b2097502182b13e9c06433d248609b037005ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in benjimain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81874f877a599ba4cd7f60d6888ff32a9768be0126b292e92f2b1716c2b88135 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in recxn-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fccd7ee6ab1ab371569d54327f1be159efb74e581af0866b91b5b724e9c4cacb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Qlik Qlikview 安全漏洞

Qlik QlikView is Qlik's for rapid development and delivery of interactive guided analytics applications and dashboards. A security vulnerability exists in Qlik Qlikview May 2022 SR3 prior to 12.70.20300, and in Qlikview May 2023 SR2 prior to 12,80.20200 versions, which stems from a race condition...

Malicious code in shopify-app-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ab44e75760c84102aeb55e53e2c77bb85fc0839e0873eb6dc778f14756e0bd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in u-workflow.module.common.visibility (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f6dcf3beecd86989a7b3a417a5bf6ae97e3b29c18583b6022dcf50a8a1ec988a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

karl-may.de Cross Site Scripting vulnerability OBB-3878378

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in custom-banner-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34d3a0ada39e2fd82258a3fc7c24701af1389dc5d9de771dd18d930e9ccc2ad3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in action-and-block (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0df7d68df29c8d0451564e890d6a9e4e49ed0d52b81b51c81ab79c1bb6fabac3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...