Malicious code in advdef01 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 44ffce32113cbe3c908fd584f4b02617cafcfecccc3cea1c4fc068021c4bfa7d Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

CVE-2024-6270

The Community Events WordPress plugin before 1.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3636

The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3636

The Pinpoint Booking System WordPress plugin before 2.9.9.4.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-2872

The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-2872 Swift Framework < 2024.04.30 - Contributor+ Stored XSS

The socialdriver-framework WordPress plugin before 2024.04.30 does not sanitise and escape some of its settings, which could allow high privilege users such as contributor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...

CVE-2024-2872

The socialdriver-framework WordPress plugin, in versions prior to 2024.04.30 , is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is the failure to properly sanitise and escape certain settings, which allows high-privilege users, such as those with contributor roles, to execute X...

PT-2024-38319 · Chargepoint · Chargepoint Home Flex

Name of the Vulnerable Software and Affected Versions: ChargePoint Home Flex affected versions not specified Description: This issue allows network-adjacent attackers to disclose sensitive information on affected installations of ChargePoint Home Flex charging devices. The specific flaw exists...

kernel: scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup()

In the Linux kernel, the following vulnerability has been resolved: scsi: libfc: Fix potential NULL pointer dereference in fclportptpsetup fclportptpsetup did not check the return value of fcrportcreate which can return NULL and would cause a NULL pointer dereference. Address this issue by checki...

CVE-2024-6536 Zephyr Project Manager < 3.3.99 - Editor+ XSS

The Zephyr Project Manager WordPress plugin before 3.3.99 does not sanitise and escape some of its settings, which could allow high privilege users such as editors and admins to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in...

PT-2024-23793 · WordPress · Formflow: Whatsapp Social/Advanced Form Builder With Easy Lead Collection

Name of the Vulnerable Software and Affected Versions: The FormFlow: WhatsApp Social and Advanced Form Builder with Easy Lead Collection WordPress plugin versions prior to 2.12.2 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, ev...

CVE-2024-6487

The Inline Related Posts WordPress plugin before 3.8.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Apple macOS 安全漏洞

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Sonoma prior to version 14.6, which stems from the fact that enabling Locked Mode when setting up a Mac may cause FileVault to be accidentally disabled...

Exploit for Path Traversal in Microsoft

Exploiting Follina CVE and CVE-2021-40444 Vulnerabilities...

PT-2024-37722 · WordPress · Aramex Shipping Woocommerce

Name of the Vulnerable Software and Affected Versions: Aramex Shipping WooCommerce plugin for WordPress versions up to, and including, 1.1.21 Description: The issue allows unauthenticated attackers to retrieve the full path of the web application, which can aid other attacks. This is due to the...

Malicious code in blabb111 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ffda2d8463a0c5bb11dd5c29ecff67cf6b958e1edf44822e749327c8d155817e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in wave-opensdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5dbda9bf70afa0311dbd7b22b5209531b90399bcc4a5cd5846d3f5fa89314f47 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in c8tsdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4952c202b499114b83119ae00b4dfcb6ad81c3ff47accd61174ef279f7244eae Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in c8test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 b94beda1abe6cca6b53ac1891e3a3baea95df1b8c260dd9f4ea15998e26391b9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in c8tks94kspjyhtb (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 55ea5b13a1064ea6ada9f0d6ac879a6b269b476871734f578f6c097a5baa73f3 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...