CVE-2022-1847

The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

Cross site request forgery (csrf)

The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1847 Rotating Posts <= 1.11 - Arbitrary Settings Update to Stored XSS via CSRF

The Rotating Posts WordPress plugin through 1.11 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1847

CVE-2022-1847 affects the WordPress Rotating Posts plugin (versions

WordPress plugin Rotating Posts 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress Rotating Posts plugin version 1.11 and earlier versions are vulnerable to cross-site request forger...

MAL-2022-6238 Malicious code in splitsoftware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ad35b9c145bad6f82667ea92999ab0608a42c73b8db804560c5f63f5b8cb805 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-262 Malicious code in @fb-pfpcommon/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd8a0261fbb5b751bdde66ad91553a2d6586c281d272ae8309cca16eabae8dc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-406 Malicious code in @maalik/logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4c90984124534f66b230ac2eb92a0364a88b33f5c02db2cba4e3a47086f9f3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6610 Malicious code in toosting (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e25283d8528a1beafc7230c24579e63f590b0e68bf6c7daa9522e03861563a4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6565 Malicious code in thumb-assembler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a778dc093a4b19a51f799a5bf03fb7714d70147b42627bafbef5bb2c87e33a82 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-9 Malicious code in 0-dns (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9345f1024aa16e4fbd012768ffc1ab4a6aa5863e13d3abb1043dbc7e503fa35f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1580 Malicious code in bindingx-weex-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ad15e3937f59b8740d5b69e0bf7b6647f01d5302aef2e1089d0d64ad88a69a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5966 Malicious code in scilla-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae6d1f0d1971141f69900a006415517ea9fa86921fdb5ecb8c24c6b219b5964d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4511 Malicious code in mb-blog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 658aa7eb483cfd352b2c2c628d938ac8566bbf7cbb32d0e806867d1abcc8ae24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Rotating Posts plugin <= 1.11 - Arbitrary Settings Update to Stored XSS via CSRF vulnerability

Arbitrary Settings Update to Stored XSS via CSRF vulnerability discovered by Daniel Ruf in WordPress Rotating Posts plugin versions = 1.11. Solution Deactivate and delete. This plugin has been closed as of May 24, 2022 and is not available for download. This closure is temporary, pending a full...

MAL-2022-5260 Malicious code in pco_api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9c8289fc4eb78d3e66ed76818f5f799edc0dbee5bebe64774a03a2c3148158b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-GVM7-8FQ3-QJJ2 Malicious Package in bs85

All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated...

Malicious Package in hsf-clients

All versions of hsf-clients contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that...

GHSA-WP2P-Q35G-3RJJ Malicious Package in soket.io

All versions of soket.io are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitrary commands. Recommendation This...

Malicious Package

Overview All versions of cage-js contains malicious code. The malware downloads and runs a script from a remote server as a postinstall script. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comput...