Malicious code in @zohocalendar/color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 018ff1f8a690ddf8dc7352e23396e32046f51398b2d4457ceeed66230f49f832 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7122 Malicious code in wf-react-day-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7658e188c01b95c2094d6883c614c8a11042e58f4984d7ae00cc19f7b1ec2236 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-797 Malicious code in @zohocalendar/date-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e54ac2c0d6ff767b9cffa8d41103fdf6e8e82c6a74c6898243f4ef5d6d836909 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @zohocalendar/date-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e54ac2c0d6ff767b9cffa8d41103fdf6e8e82c6a74c6898243f4ef5d6d836909 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

jquery-ui: XSS in the altField option of the datepicker widget

jQuery-UI is the official jQuery user interface library. Prior to version 1.13.0, accepting the value of the altField option of the Datepicker widget from untrusted sources may execute untrusted code. The issue is fixed in jQuery UI 1.13.0. Any string value passed to the altField option is now...

Arbitrary Code Injection

Overview typo3/cms is a free open source Content Management Framework. Affected versions of this package are vulnerable to Arbitrary Code Injection via the Color Picker Wizard component. Remediation Upgrade typo3/cms to version 6.1.9, 6.0.14, 4.7.19, 4.5.34 or higher. References - OpenSuse Securi...

TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object...

GHSA-55G3-FJWM-W2C8 TYPO3 Color Picker Wizard component allows remote authenticated editors to execute arbitrary PHP code

The Color Picker Wizard component in TYPO3 4.5.0 before 4.5.34, 4.7.0 before 4.7.19, 6.0.0 before 6.0.14, and 6.1.0 before 6.1.9 allows remote authenticated editors to execute arbitrary PHP code via a serialized PHP object...

Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module

Multiple cross-site scripting XSS vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename...

GHSA-89F3-74M6-G27G Moodle Multiple cross-site scripting (XSS) vulnerabilities in the File Picker module

Multiple cross-site scripting XSS vulnerabilities in the File Picker module in Moodle 2.x through 2.1.10, 2.2.x before 2.2.8, 2.3.x before 2.3.5, and 2.4.x before 2.4.2 allow remote authenticated users to inject arbitrary web script or HTML via a crafted filename...

CVE-2021-39804

In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check. This could lead to remote persistent denial of service in the file picker with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11...

CVE-2021-39804

In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check. This could lead to remote persistent denial of service in the file picker with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11...

CVE-2021-39804

In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check. This could lead to remote persistent denial of service in the file picker with no additional execution privileges needed. User interaction is needed for exploitation.Product: AndroidVersions: Android-11...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc. A security vulnerability exists in Google Chrome, which is caused by the window.showSaveFilePicker function that parses and returns environment variable values to the user when passing environment variables, which can be exploited by an attacker to...

ASB-A-215002587

In reinit of HeifDecoderImpl.cpp, there is a possible crash due to a missing null check. This could lead to remote persistent denial of service in the file picker with no additional execution privileges needed. User interaction is needed for exploitation...

WordPress Date Picker by Input WP – Sync bookings with external Calendars (.ics) plugin <= 2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Date Picker by Input WP – Sync bookings with external Calendars .ics plugin versions = 2.1. Solution Update the WordPress Date Picker by Input WP – Sync bookings with external Calendars .ics plugin to...

WordPress Date Picker by Input WP – Sync bookings with external Calendars (.ics) plugin <= 2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Date Picker by Input WP – Sync bookings with external Calendars .ics plugin versions = 2.1. Solution Update the WordPress Date Picker by Input WP – Sync bookings with external Calendars .ics plugin to the latest available...

WordPress Location Picker at Checkout for WooCommerce plugin <= 1.4.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Location Picker at Checkout for WooCommerce plugin versions = 1.4.4. Solution Update the WordPress Location Picker at Checkout for WooCommerce plugin to the latest available version at least 1.4.5...

Browsing /jira/rest/api/2/user/picker as an unauthenticated user should return 401

h3. Issue Summary Browsing /jira/rest/api/2/user/picker?query=username as unauthenticated always returns 404, along with the following message: code:java "errorMessages":"The user named '0' does not exist","errors": code h3. Steps to Reproduce Open an browser private window Browse...

Content Spoofing

chrome is vulnerable to content spoofing. The vulnerability exists due to a lack of enforcement on the police in contacts picker in Google Chrome allowing an attacker to spoof the contents of the Omnibox URL bar via a crafted HTML page...