MAL-2023-8091 Malicious code in pretty-array (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c13ccb71946d796fddfaa2f62631f277063b7f3230d5fd22d783585b8ed16391 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CSZ CMS 跨站脚本漏洞

CSZ CMS is an open source PHP-based content management system CMS. A security vulnerability exists in CSZ CMS version 1.3.0, which can be exploited by an attacker to execute arbitrary web script or HTML via a crafted payload entered in the Carousel Wiget and via rotating widgets created on top of...

MAL-2023-1036 Malicious code in hackzvijay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware baa21bf2e50d46d8e86793d9a3b251a8fa8a72c0d1ca1086e4f68817a48a9d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8012 Malicious code in b2b-canaisdigitais (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4dc971b04d6b1823268396807c41d808cc18fd8c2b2094b5c9ee6fb342083172 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

Malicious code in catapulse (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec297590c1fed85e684c74ef8166faf32dc8f3215dba06eebdec5de850ebe863 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5670 Malicious code in react-redux-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1317918bed3a26481cc0f2581c7902fde3cb69f75efdf9ab9f4fc365d5abf451 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6337 Malicious code in style-componenx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb248124090511a5f3edf33939c7877e6c001e2305b954ec69b81df52fbd63dd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1756 Malicious code in cabelcli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 382a921684a0a041807859f787c6f94bdb42702e85cdbb673a398765e5928122 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-QWRJ-9HMP-GPXH FlyteAdmin Insufficient AccessToken Expiration Check

Impact Authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Using flyteadmin as the OAuth2 Authorization Server is unaffected by this issue. Patches 1.1.30 Workarounds Rotating signing keys immediately will: Invalidate all...

FlyteAdmin Insufficient AccessToken Expiration Check

Impact Authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Using flyteadmin as the OAuth2 Authorization Server is unaffected by this issue. Patches 1.1.30 Workarounds Rotating signing keys immediately will: Invalidate all...

CVE-2022-31145

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Users who use FlyteAdmin...

CVE-2022-31145 Insufficient AccessToken Expiration Check in FlyteAdmin

FlyteAdmin is the control plane for Flyte responsible for managing entities and administering workflow executions. In versions 1.1.30 and prior, authenticated users using an external identity provider can continue to use Access Tokens and ID Tokens even after they expire. Users who use FlyteAdmin...

MAL-2022-6137 Malicious code in siytlnkdhzkjfevo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52567e7c157a9b8d7846b7578660ce2f3c13f8575bc3dce53c6811ba4c57edad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4087 Malicious code in jvgmepykdwfrqali (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6971ca994c3d3372b284bb2498716a09b09155ef72aecd988505e631db0c424e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5079 Malicious code in onmhfzteqydkxlrw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8940eee28704cda98dc54c7b12f39d4e5f61190a16ece0029b08efe4f673ed8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1958 Malicious code in cnqdfkysegizxbjo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35a77a13035db63a97552ef97703dc18692fbf65cedc9616e7fefb9e2b4055d3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2295 Malicious code in cwnuazejgyhiotvq (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55622203ea17afb95a132ccbf83e18e7d9f8495cda28778d67209109336bcbc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4416 Malicious code in ltpmhgzfxqbkdive (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bc25f144e99a280ceb2e8df882e5b1eabe170263dee766f71924794f7554c61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-1847

The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1847

The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...