Malicious Package

Overview spr-svg-loaders is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

CVE-2022-34179

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...

CVE-2022-34179

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...

CVE-2022-34179

CVE-2022-34179 affects Jenkins Embeddable Build Status Plugin, version 2.0.3 and earlier. The vulnerability arises from an unrestricted style query parameter used to select SVG image styles, enabling relative path traversal to SVGs on the Jenkins controller filesystem. Exploitation is possible wi...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

CVE-2022-34171

CVE-2022-34171 – Jenkins XSS in icon HTML output : Affected Jenkins core versions: 2.321–2.355 and LTS 2.332.1–2.332.3. The HTML output for new symbol-based SVG icons exposes the title attribute of l:ionicon and the alt attribute of l:icon without proper escaping, enabling cross-site scripting vi...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

CVE-2022-34179: Improper Limitation of a Pathname to a Restricted Directory

Jenkins Embeddable Build Status Plugin 2.0.3 and earlier allows specifying a style query parameter that is used to choose a different SVG image style without restricting possible values, resulting in a relative path traversal vulnerability that allows attackers without Overall/Read permission to...

Jenkins Plugin Embeddable Build Status: Path traversal vulnerability

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is an application. An open source automation server, Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is an application.Jenkins Embeddable Build Status Plugin 2.0...

CVE-2022-34171: Improper Neutralization of Input During Web Page Generation

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

Adobe InDesign Buffer Overflow RCE

The vulnerability of Adobe InDesign’s computer layout automation tool is related to writing beyond the buffer boundaries in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code using specially created data within SVG images...

Malware in zd-svg-icons

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in zd-svg-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 169e62d18b5cd6071c986b8165e474e7a6e36580804e404b65b1b2578c66d487 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7380 Malicious code in zd-svg-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 169e62d18b5cd6071c986b8165e474e7a6e36580804e404b65b1b2578c66d487 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in feast-svg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2022-2993 Malicious code in feast-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e6479c56289654bbc558ea4a0c5190871258655ce3fa766da8a33493aa24269 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in feast-svg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e6479c56289654bbc558ea4a0c5190871258655ce3fa766da8a33493aa24269 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @tinkoff-react-bui/svg-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf558b9a116b62aab931fcf875349acb6eb5f4171abaeac53c3fcdc8069f83b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-661 Malicious code in @tinkoff-react-bui/svg-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf558b9a116b62aab931fcf875349acb6eb5f4171abaeac53c3fcdc8069f83b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...