28325 matches found
Malicious code in canopus-proxima-orbit-query (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67e186216f85d63256fefaad2eb59f9195d58954971b2eab47d48a84c3dfb5b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-122938
Malicious code in query-webdriver-mocha-version-shelljs npm...
EUVD-2025-111535
Malicious code in luna-query-hyperion-hyperion npm...
EUVD-2025-122937
Malicious code in query-wezen-ophiuchus-nightwatch npm...
EUVD-2025-115194
Malicious code in command-morgan-yakutsk-query npm...
MAL-2025-141086 Malicious code in convict-query-nodejs-prettier (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 947879ab9208e82054fd505807da031763a35a0ff420bdf7e46e98c33eec225d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-140369 Malicious code in canopus-proxima-orbit-query (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67e186216f85d63256fefaad2eb59f9195d58954971b2eab47d48a84c3dfb5b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-122954
Malicious code in query-fornax-loop-lyra npm...
MAL-2025-143864 Malicious code in jasmine-query-yildun-dynamo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f632a3252972241dee863dd75f02b97f510ad5c332e9f6ff8b2dcb5eb89a139 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
PT-2025-46732
Name of the Vulnerable Software and Affected Versions Epson Stylus SX510W affected versions not specified Description The embedded web management service in the Epson Stylus SX510W does not correctly process consecutive ampersand characters within query parameters when accessing the...
PT-2025-46577
Name of the Vulnerable Software and Affected Versions ViewLead Technology Bacteriology Laboratory Reporting System affected versions not specified Description The Bacteriology Laboratory Reporting System allows unauthenticated remote attackers to inject arbitrary SQL commands, potentially enablin...
WellSky Harmony 安全漏洞
WellSky Harmony is an all-in-one service management platform from WellSky USA. A security vulnerability exists in WellSky Harmony version 4.1.0.2.83, which stems from improper cleanup of the TXTUSERID parameter in the xmHarmony.asp endpoint, which could lead to an SQL injection attack...
bind: Cache poisoning due to weak PRNG
A vulnerability was found in BIND resolvers caused by a weakness in the Pseudo Random Number Generator PRNG. This weakness allows an attacker to potentially predict the source port and query ID used by BIND, enabling cache poisoning attacks. If successful, the attacker can inject malicious DNS...
rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters
An unsafe default behavior in Rack::QueryParser allows bypass of the paramslimit parameter count restriction when query string parameters are delimited by semicolons ; rather than ampersands &. The parser counts only & when enforcing the limit, while still splitting on both & and ;. As a result, ...
database/sql: Postgres Scan Race Condition
A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leadin...
CVE-2025-59499
Improper neutralization of special elements used in an sql command 'sql injection' in SQL Server allows an authorized attacker to elevate privileges over a network...
EUVD-2025-84350
Zohocorp ManageEngine Analytics Plus versions 6170 and below are vulnerable to Unauthenticated SQL Injection due to the improper filter configuration...
rubygem-rack: Rack QueryParser has an unsafe default allowing params_limit bypass via semicolon-separated parameters
An unsafe default behavior in Rack::QueryParser allows bypass of the paramslimit parameter count restriction when query string parameters are delimited by semicolons ; rather than ampersands &. The parser counts only & when enforcing the limit, while still splitting on both & and ;. As a result, ...
database/sql: Postgres Scan Race Condition
A flaw was found in database/sql. Concurrent queries can produce unexpected results when a query is cancelled during a Scan method call on returned Rows, creating a race condition. This vulnerability allows an attacker who can initiate and cancel queries to trigger this condition, possibly leadin...
