MAL-2022-7362 Malicious code in youtrack-board-status-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e36936236b22c94633885c6923c845a98a8d11ba12d2aef38bb4c45524b4df1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in youtrack-board-status-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1e36936236b22c94633885c6923c845a98a8d11ba12d2aef38bb4c45524b4df1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3711 Malicious code in hub-project-team-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7c794f406836eb00a75225254917bf75481a01646687d3e3ee49973962b3872 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in youtrack-exportable-work-items-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9f6a061ddcc82ed6b2d87dfc85057460d0e69c829ef7a659fc7b01dfeb1fe17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7363 Malicious code in youtrack-exportable-work-items-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f9f6a061ddcc82ed6b2d87dfc85057460d0e69c829ef7a659fc7b01dfeb1fe17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hub-rss-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3158b4ecaff25a1c2e806a027dc70cd4f3c129c035ab63635299227ef24766b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3713 Malicious code in hub-rss-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3158b4ecaff25a1c2e806a027dc70cd4f3c129c035ab63635299227ef24766b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6434 Malicious code in teamcity-build-artifacts-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 235e70f767d4caae7345fc80ce5bf59a7609ad9293fb2e2a74f70477ae9cac1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7366 Malicious code in youtrack-personal-timetracking-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 610a58ca854641cb2f1d0a376d543e2d48ba72931f64d153356eac5c176dd1cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in youtrack-personal-timetracking-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 610a58ca854641cb2f1d0a376d543e2d48ba72931f64d153356eac5c176dd1cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pseudo-loc-for-signin-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d100c05109c3b4d84fa03d2463e93fb0b235b5e8f13d497016d190fdbcfc1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5506 Malicious code in pseudo-loc-for-signin-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d100c05109c3b4d84fa03d2463e93fb0b235b5e8f13d497016d190fdbcfc1da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2215 Malicious code in courage-for-signin-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 651ba90b6cbf4d05699e79773d63de9bb241b1d23330c1d88b9c2032e8bd52ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in courage-for-signin-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 651ba90b6cbf4d05699e79773d63de9bb241b1d23330c1d88b9c2032e8bd52ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1843 Malicious code in cat-weather-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e88ace5963f5686d2f51198d181864c25de04bd9fa46139da3ecf262068144c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cat-weather-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e88ace5963f5686d2f51198d181864c25de04bd9fa46139da3ecf262068144c0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Button Widget Smartsoft <= 1.0.1 - Arbitrary Settings Update to Stored XSS via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack, as well as put XSS payloads in them due to the lack of sanitisation and escaping...

WordPress Button Widget Smartsoft plugin <= 1.0.1 - Cross-Site Request Forgery (CSRF) vulnerability to Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability to Cross-Site Scripting XSS was discovered by Ryo Onodera Cryptography Laboratory Tokyo Denki University in the WordPress Button Widget Smartsoft plugin versions = 1.0.1. Solution Deactivate and delete. This plugin has been closed as of June 8, 2022 a...

WordPress Plugin Latest Tweets Widget Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in WordPress plugin Latest Tweets Widget 1.1.4 and prior versions, which stems from a CSRF check...

CVE-2022-1624

The Latest Tweets Widget WordPress plugin through 1.1.4 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...