CVE-2024-7739

A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used...

CVE-2024-7739 yzane vscode-markdown-pdf cross site scripting

A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used...

CVE-2024-7739

CVE-2024-7739 affects the yzane vscode-markdown-pdf extension (version 1.5.0). The issue is a cross-site scripting vulnerability caused by manipulation in an unknown part of the extension, with remote exploitation possible. The vulnerability is publicly disclosed and has PoC materials referenced ...

CVE-2024-7739 yzane vscode-markdown-pdf cross site scripting

A vulnerability, which was classified as problematic, was found in yzane vscode-markdown-pdf 1.5.0. This affects an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used...

CVE-2024-7738 yzane vscode-markdown-pdf Markdown File pathname traversal

A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation leads to pathname traversal. Attacking locally is a requirement. The exploit has...

CVE-2024-7738 yzane vscode-markdown-pdf Markdown File pathname traversal

A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation leads to pathname traversal. Attacking locally is a requirement. The exploit has...

CVE-2024-7738

The CVE-2024-7738 entry affects yzane vscode-markdown-pdf 1.5.0 (Markdown File Handler) and describes a pathname traversal vulnerability exploitable with local access. Several connected sources confirm the issue, with exploitation disclosed publicly (POCs/videos referenced). The root cause is unk...

CVE-2024-7738 yzane vscode-markdown-pdf Markdown File pathname traversal

A vulnerability, which was classified as problematic, has been found in yzane vscode-markdown-pdf 1.5.0. Affected by this issue is some unknown functionality of the component Markdown File Handler. The manipulation leads to pathname traversal. Attacking locally is a requirement. The exploit has...

PT-2024-38547

Name of the Vulnerable Software and Affected Versions: yzane vscode-markdown-pdf version 1.5.0 Description: A problematic issue was found in the software, affecting an unknown part. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The exploit has bee...

Malicious code in pkl-vscode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36b102f69e16083459cf07d2c10dfa74f8921dd7e8eda6686d1ded62b468de73 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-ui5-language-assistant (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9629544d283355bc3e5f8a20f5d3d42bf915bee3fc09af17209a8d17e97642d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-3833 Malicious code in vscode-dev-containers (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-3832 Malicious code in vscode-codeql (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in vscode-codeql (npm)

--- -= Per source details. Do not edit below this line.=-...

Metasploit Weekly Wrap-Up 06/14/2024

New module content 5 Telerik Report Server Auth Bypass Authors: SinSinology and Spencer McIntyre Type: Auxiliary Pull request: 19242 contributed by zeroSteiner Path: scanner/http/telerikreportserverauthbypass AttackerKB reference: CVE-2024-4358 Description: This adds an exploit for CVE-2024-4358...

VSCode ipynb Remote Code Execution Exploit

VSCode when opening a Jupyter notebook .ipynb file bypasses the trust model. On versions v1.4.0 through v1.71.1, its possible for the Jupyter notebook to embed HTML and javascript, which can then open new terminal windows within VSCode. Each of these new windows can then execute arbitrary code at...

VSCode ipynb Remote Development RCE

VSCode when opening an Jupyter notebook .ipynb file bypasses the trust model. On versions v1.4.0 - v1.71.1, its possible for the Jupyter notebook to embed HTML and javascript, which can then open new terminal windows within VSCode. Each of these new windows can then execute arbitrary code at...

VSCode ipynb Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'VSCode ipynb Remote Development RCE', 'Description' = %q VSCode when opening an Jupyter notebook .ipynb file bypasses the trust model. On version...

GitLens Git Local Configuration Execution Exploit

GitKraken GitLens versions prior to 14.0.0 allow an untrusted workspace to execute git commands. A repo may include its own .git folder including a malicious config file to execute arbitrary code. Tested against VSCode 1.87.2 with GitLens 13.6.0 on Ubuntu 22.04 and Windows 10. This module require...

GitLens Git Local Configuration Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'GitLens Git Local Configuration Exec', 'Description' = %q GitKraken GitLens before v.14.0.0 allows an untrusted workspace to execute git commands...