WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion

The plugin contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user...

samba -- Multiple vulnerabilities

The Samba Team reports: CVE-2022-2031 The KDC and the kpasswd service share a single account and set of keys, allowing them to decrypt each other's tickets. A user who has been requested to change their password can exploit this to obtain and use tickets to other services. CVE-2022-32744 The KDC...

WordPress Team Members Showcase < 4.1.2 - Subscriber+ Arbitrary File Read and Deletion

The plugin contains a file which could allow any authenticated users to download arbitrary files from the server via a path traversal vector. Furthermore, the file will also be deleted after its content is returned to the user PoC...

WordPress wpWax Team Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress wpWax Team 1.2.6 and prior versions, which stems from the program's lack of checksum...

Malicious code in @cobalt-team/multi-invite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e37ea81ad98e89c5f266cfa910ba2604c209fb890e8da13de13eb33951c1948e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-175 Malicious code in @cobalt-team/support-email (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4415fff565dfcd73b3d7b833cb710c1c434e9b840697cb99f753d7b69258c01a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-174 Malicious code in @cobalt-team/multi-invite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e37ea81ad98e89c5f266cfa910ba2604c209fb890e8da13de13eb33951c1948e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-34853

Multiple Authenticated contributor or higher user role Persistent Cross-Site Scripting XSS vulnerabilities in wpWax Team plugin = 1.2.6 at WordPress...

CVE-2022-34853

Multiple Authenticated contributor or higher user role Persistent Cross-Site Scripting XSS vulnerabilities in wpWax Team plugin = 1.2.6 at WordPress...

CVE-2022-34650

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in wpWax Team plugin = 1.2.6 at WordPress...

CVE-2022-34650

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in wpWax Team plugin = 1.2.6 at WordPress...

CVE-2022-34650 WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in wpWax Team plugin = 1.2.6 at WordPress...

CVE-2022-34650 WordPress Team plugin <= 1.2.6 - Multiple Authenticated Stored Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated contributor or higher user role Stored Cross-Site Scripting XSS vulnerabilities in wpWax Team plugin = 1.2.6 at WordPress...

CVE-2022-34650

CVE-2022-34650 describes multiple authenticated Stored Cross-Site Scripting (XSS) vulnerabilities in the WordPress plugin wpWax Team (versions

CVE-2022-34853

CVE-2022-34853 affects the WordPress plugin wpWax Team (≤ 1.2.6). The vulnerability is a persistent XSS that requires authentication from a contributor or higher user role; it arises from inadequate sanitisation/escaping of user-supplied data in the plugin. Impact is client-side script execution;...

CVE-2022-31168

CVE-2022-31168 affects Zulip Server 5.4 and earlier, where an incorrect authorization check could let a member escalate a bot’s privileges to organization administrator via an API call. The vulnerability is addressed in Zulip Server 5.5. Workarounds include restricting the Who can create bots to ...

CVE-2022-31168 Zulip Server insufficient authorization for changing bot roles

Zulip is an open source team chat tool. Due to an incorrect authorization check in Zulip Server 5.4 and earlier, a member of an organization could craft an API call that grants organization administrator privileges to one of their bots. The vulnerability is fixed in Zulip Server 5.5. Members who...

michiganlakesteam.com Cross Site Scripting vulnerability OBB-2807706

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious Package

Overview flipper-server-companion is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

DOM-based Cross-Site Scripting (XSS) in OpenEMR 7.0.0 and below at White list files

Description We would like to report the vulnerability we found during software testing. The OpenEMR 7.0.0 latest version and below version; Open Source electronic health records and medical practice management application; has DOM-based Cross-Site Scripting XSS vulnerability in the...