Download Manager < 3.2.53 - Unauthenticated Reflected Cross-Site Scripting

The plugin does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute of the modal login page only available when users are not logged in, which could lead to Reflected Cross-Site Scripting in old web browsers. On the modal login page from the plugin and using an...

MAL-2022-5877 Malicious code in rv-modal-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56cf259076204ead00ddb8d24a7b19b24a7ebc650df13dd4df62139102b1349c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rv-modal-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56cf259076204ead00ddb8d24a7b19b24a7ebc650df13dd4df62139102b1349c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deere-ui-modal-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab5f051a5313a4e821d35c89b9ae609af1631fe812808fbb41d82fd676605154 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2409 Malicious code in deere-ui-modal-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab5f051a5313a4e821d35c89b9ae609af1631fe812808fbb41d82fd676605154 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview deere-ui-modal-core is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

Cross-site Scripting (XSS) - Stored in Space Name

Description Cross-site Scripting XSS - Stored in space name. Because space name is not HTML encoded, "Confirm action" modal pops up then the script is executed. Proof of Concept Step 1: Create a new Space and fill in name with this payload: "alert1. Step 2: Send an invite to victim then save. Ste...

Malicious Package

Overview rv-modal-store is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious Package

Overview nin-modal is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

MAL-2022-1477 Malicious code in bc-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c349aa8dccfb6002d5ac7819ce5e0f9549e788225ddcc8c475c9f36d1d600b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bc-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7c349aa8dccfb6002d5ac7819ce5e0f9549e788225ddcc8c475c9f36d1d600b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in editor-with-wrapper-no-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51686c2414d61dee9e94ea84369aa9e2aac2ae6984737e6007c2566b8a9ff569 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ricos-editor-no-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e8a7f053bb5cc48e3ba19ffaaaa72dc32fd0f1abbc14f5f39a215d86e8b5575 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ricos-viewer-no-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 267187e37b6882296c6be2e3e181c04fe91554c4e293f2ba843517b8c24861e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5793 Malicious code in ricos-viewer-no-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 267187e37b6882296c6be2e3e181c04fe91554c4e293f2ba843517b8c24861e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5791 Malicious code in ricos-editor-no-modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5e8a7f053bb5cc48e3ba19ffaaaa72dc32fd0f1abbc14f5f39a215d86e8b5575 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tinkoff-react-bui/modal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 783802d9c19b708d0e12629ff6845be4364fa49987d67dacecdb6bc733d322b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SS CMS 跨站脚本漏洞

SS CMS is a .NET Core-based platform for siteserver individual developers to build a full-featured, high-performance, large-scale and easy-to-maintain website in the shortest possible time at the lowest cost and with the least amount of labor. A cross-site scripting vulnerability exists in SS CMS...

Cross site scripting

A Cross Site Scripting XSS vulnerability exists in Yogesh Ojha reNgine v1.0 via the Scan Engine name file in the Scan Engine deletion confirmation modal box...

WordPress Modal Window plugin cross-site request forgery vulnerability

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The WordPress Modal Window plugin was vulnerable to cross-site request forgery prior to 5.2.2. The vulnerability stems from the plugin's failure to effectively filter calls to remote file resources...