PT-2023-31770 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R Gh version 1.0.0-B20230221.0948.web Description: A stack overflow issue was discovered via the function formRoute. Recommendations: For TOTOLINK X2000R Gh version 1.0.0-B20230221.0948.web, consider disabling the formRoute...

PT-2023-31772 · Totolink · Totolink X2000R

Name of the Vulnerable Software and Affected Versions: TOTOLINK X2000R Gh version 1.0.0-B20230221.0948.web Description: The issue is related to a stack overflow via the function formRebootSchedule. Recommendations: For TOTOLINK X2000R Gh version 1.0.0-B20230221.0948.web, as a temporary workaround...

Malicious code in tsrcrcetest1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 81236969e1e7e6ddfdffe293e1d918b357ce193fc362e722a7b75bce480e1bbb The OpenSSF Package Analysis project identified 'tsrcrcetest1' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in rcetest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9ee58b9e6d758cb339bd2d6605b131d84f7829a9299889967e3f5ca31d69d120 The OpenSSF Package Analysis project identified 'rcetest' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes o...

Malicious code in excaliburx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d763da65172935a20c3b03c65deff16a2eb251d857d1fc34e4cc67b72f7610a Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in newpackagetest2028 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 3f8a309179fb8daa3b3ff1d8a250fe566f5d138ab913e435928491185de07f1c Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

PT-2023-30486 · WordPress · Wp Edit Username

Name of the Vulnerable Software and Affected Versions: WP Edit Username versions 1.0.0 through 1.0.5 Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. Specifically, it is a Stored XSS...

CVE-2023-49166

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Magic Logix MSync.This issue affects MSync: from n/a through 1.0.0...

PT-2023-20395 · Unknown · Zendrop – Global Dropshipping

Name of the Vulnerable Software and Affected Versions: Zendrop – Global Dropshipping versions 1.0.0 and earlier Description: The issue is related to an Unrestricted Upload of File with Dangerous Type, which affects Zendrop – Global Dropshipping. This allows for the upload of files with potentiall...

PT-2023-24642 · Unknown · Wc Recently Viewed Products

Name of the Vulnerable Software and Affected Versions: Rajnish Arora Recently Viewed Products versions n/a through 1.0.0 Description: The issue is related to Deserialization of Untrusted Data, which affects the Recently Viewed Products module. Recommendations: For versions n/a through 1.0.0, at t...

RtspServer Security Vulnerability

RtspServer is an RTSP server and pusher based on C++11. A security vulnerability exists in RtspServer version 1.0.0, which stems from a buffer overflow vulnerability in the file RtspMesage.cpp...

PT-2023-32799 · Unknown · Phz76 Rtspserver

Name of the Vulnerable Software and Affected Versions: PHZ76 RtspServer version 1.0.0 Description: A critical issue was found in the ParseRequestLine function of the RtspMesaage.cpp file, leading to a stack-based buffer overflow. This issue can be exploited remotely. The exploit has been disclose...

Code injection

Laf is a cloud development platform. Prior to version 1.0.0-beta.13, the control of LAF app enV is not strict enough, and in certain scenarios of privatization environment, it may lead to sensitive information leakage in secret and configmap. In ES6 syntax, if an obj directly references another...

evershop-app (=0.1.0) potentially affected by CVE-2023-46496 via @evershop/evershop (=1.0.0-rc.5)

@evershop/evershop NPM version =1.0.0-rc.5 is affected by a known vulnerability. The following packages have a transitive dependency on @evershop/evershop and may be impacted: - evershop-app =0.1.0 Source cves: CVE-2023-46496 Source advisory: OSV:GHSA-RWF3-W4JQ-F4CM...

CVE-2023-46499

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel...

CVE-2023-46499

Cross Site Scripting vulnerability in EverShop NPM versions before v.1.0.0-rc.5 allows a remote attacker to obtain sensitive information via a crafted scripts to the Admin Panel...

EverShop Security Breach

EverShop is EverShop open source a NodeJS e-commerce platform. A security vulnerability exists in EverShop versions prior to v.1.0.0-rc.5. A remote attacker can exploit this vulnerability to obtain sensitive information from the admin panel via a specially crafted script...

PT-2023-30056 · Npm · Evershop

Name of the Vulnerable Software and Affected Versions: EverShop NPM versions prior to 1.0.0-rc.8 Description: The issue allows a remote attacker to obtain sensitive information via a crafted request to the "DELETE" function in the "api/files" endpoint. Recommendations: For versions prior to...

PT-2023-30059 · Npm · Evershop

Name of the Vulnerable Software and Affected Versions: EverShop NPM versions prior to 1.0.0-rc.5 Description: The issue allows a remote attacker to obtain sensitive information via crafted scripts to the Admin Panel. This is a Cross Site Scripting vulnerability. Recommendations: For versions prio...

Authorization

CodeIgniter Shield is an authentication and authorization provider for CodeIgniter 4. In affected versions successful login attempts are recorded with the raw tokens stored in the log table. If a malicious person somehow views the data in the log table they can obtain a raw token which can then b...