Malicious code in react-vis-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis add23f4d15e6249dcdf1487e1ba15a538376d6c820e7afecf316deaf47dbd959 The OpenSSF Package Analysis project identified 'react-vis-website' @ 1.1.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11874 Malicious code in react-vis-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis add23f4d15e6249dcdf1487e1ba15a538376d6c820e7afecf316deaf47dbd959 The OpenSSF Package Analysis project identified 'react-vis-website' @ 1.1.0 npm as malicious. It is considered malicious because: - The package...

SUSE-SU-2024:4324-1 Security update for MozillaFirefox

This update for MozillaFirefox fixes the following issues: Update to Firefox Extended Support Release 128.5.1 ESR bsc1234326: - Fixed an issue that prevented some websites from loading when using SSL Inspection. bmo1933747...

Malicious ad distributes SocGholish malware to Kaiser Permanente employees

On December 15, we detected a malicious campaign targeting Kaiser Permanente employees via Google Search Ads. The fraudulent ad masquerades as the health care company's HR portal used to check for benefits, download paystubs and other corporate related tasks. We believe the threat actors' intent...

CVE-2024-11711: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'resumeid' parameter in all versions up to, and including, 2.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2024-11710: Improper Neutralization of Special Elements used in an SQL Command

The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to SQL Injection via the 'fieldfor', 'visibleParent' and 'id' parameters in all versions up to, and including, 2.2.2 due to insufficient escaping on the user supplied parameter an...

Naumen Service Management Platform XSS

The vulnerability of the Naumen Service Management Platform Naumen SMP Portal lies in the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

Malicious code in fidentity-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce37a844e887ce29a4c02c56af5b1d9ce7e31d1955ef5606b1a5e6be05d152d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11815 Malicious code in fidentity-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce37a844e887ce29a4c02c56af5b1d9ce7e31d1955ef5606b1a5e6be05d152d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in internal-website

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2024-12338

CVE-2024-12338 affects Website Toolbox Community plugin for WordPress. The vulnerability is a Reflected Cross-Site Scripting via the websitetoolbox_username parameter in all versions up to 2.0.1, caused by insufficient input sanitization and output escaping. Impact: attackers can inject web scrip...

CVE-2024-12338 Website Toolbox Community <= 2.0.1 - Reflected Cross-Site Scripting via websitetoolbox_username

The Website Toolbox Community plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘websitetoolboxusername’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

WordPress Website Toolbox Community plugin <= 2.0.1 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Website Toolbox Community versions = 2.0.1...

Drupal CMS XSS

The vulnerability of the Drupal CMS system’s kernel is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

Drupal CMS XSS

The vulnerability of the Drupal CMS system is related to insufficient protection of the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks...

CVE-2024-12338: Improper Neutralization of Input During Web Page Generation

The Website Toolbox Community plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘websitetoolboxusername’ parameter in all versions up to, and including, 2.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attacker...

WordPress Plugin Website Toolbox Community Cross-Site Script Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...

PT-2024-17550 · WordPress · Website Toolbox Community

Name of the Vulnerable Software and Affected Versions: Website Toolbox Community plugin for WordPress versions up to, and including, 2.0.1 Description: The issue is related to Reflected Cross-Site Scripting, which occurs due to insufficient input sanitization and output escaping. This allows...

OSGeo GeoServer XSS

The vulnerability of the software for managing and publishing geodata on the OSGeo GeoServer server exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor, operating remotely, to perform cross-site scripting attacks X...

Malicious code in lfs-au-website-build (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c1cede85f63ef726a200198c527060cd81e0506a726fc5ad92ce154a3873e99 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...