Malicious code in sap-adminpass (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6cb3a6c9207dbd171426502a8980c0c182bcd9c5150388ffe4689447f011376a The OpenSSF Package Analysis project identified 'sap-adminpass' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sap-added (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 690c89393c1cd2e1cb373bbeb5814983ffd3c010ffd6a154daf6c46828f46423 The OpenSSF Package Analysis project identified 'sap-added' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sap-accountid (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d80cf1beddae1149d89422bd3b18a14427df5e924a6ba9c01f0a19c33f69ac69 The OpenSSF Package Analysis project identified 'sap-accountid' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

PT-2024-10363 · Acquia · Acquia Dam

Name of the Vulnerable Software and Affected Versions: Acquia DAM versions 0.0.0 through 1.0.12 Acquia DAM versions 1.1.0 through 1.1.0-beta2 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Acquia DAM module of the Drupal CMS system. This vulnerability...

PT-2024-10357 · Drupal · Migrate Queue Importer

Name of the Vulnerable Software and Affected Versions: Migrate queue importer versions 0.0.0 through 2.1.1 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Migrate queue importer module of the Drupal content management system. This vulnerability allows f...

PT-2024-10094 · Drupal · Drupal Rest & Json Api Authentication

Name of the Vulnerable Software and Affected Versions: Drupal REST & JSON API Authentication versions 0.0.0 through 2.0.12 Description: The issue is related to an Incorrect Authorization vulnerability in Drupal REST & JSON API Authentication, allowing Forceful Browsing. This can enable a remote...

PT-2024-25405 · Wpcustomify · Wpcustomify Customify Site Library

Name of the Vulnerable Software and Affected Versions: WPCustomify Customify Site Library versions 0.0.0 through 0.0.9 Description: The issue is related to an Improper Control of Generation of Code, also known as 'Code Injection', which affects the WPCustomify Customify Site Library. This allows...

PT-2024-10086 · Drupal · Drupal Advanced Pwa Inc Push Notifications

Name of the Vulnerable Software and Affected Versions: Drupal Advanced PWA inc Push Notifications versions 0.0.0 through 1.5.0 Description: The issue is related to an incorrect authorization vulnerability in the Drupal Advanced PWA inc Push Notifications module, which allows for forceful browsing...

PT-2024-10136 · Tacjs · Tacjs

Name of the Vulnerable Software and Affected Versions: TacJS versions 0.0.0 through 6.4.9 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-Site Scripting XSS attacks. This can enable a remote attacker to perform inter-site...

PT-2024-10099 · Drupal · Drupal Registration Role

Name of the Vulnerable Software and Affected Versions: Drupal Registration role versions 0.0.0 through 2.0.0 Description: The issue is related to an Incorrect Privilege Assignment vulnerability in the Drupal Registration role, which allows for Privilege Escalation. This vulnerability can be...

PT-2024-10076 · Drupal · Drupal Symfony Mailer Lite

Name of the Vulnerable Software and Affected Versions: Drupal Symfony Mailer Lite versions 0.0.0 through 1.0.6 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability, which can be exploited by a remote attacker to perform a CSRF attack. This vulnerability affects the...

PT-2024-10128 · Drupal · Drupal Coffee

Name of the Vulnerable Software and Affected Versions: Drupal Coffee versions 0.0.0 through 1.4.0 Description: The issue is related to improper neutralization of input during web page generation, which allows Cross-Site Scripting XSS. This can be exploited by a remote attacker to conduct a...

PT-2024-10354 · Drupal · Node Access Rebuild Progressive

Name of the Vulnerable Software and Affected Versions: Node Access Rebuild Progressive versions 0.0.0 through 2.0.1 Node Access Rebuild Progressive version prior to 2.0.2 can be simplified to the above range, so it is omitted to avoid duplication. Description: The issue is related to improper...

PT-2024-10361 · Drupal · Drupal Entity Delete Log

Name of the Vulnerable Software and Affected Versions: Drupal Entity Delete Log versions 0.0.0 through 1.1.1 Description: The issue is related to a lack of authorization in the Drupal Entity Delete Log, which allows for forceful browsing. This can enable a remote attacker to bypass security...

PT-2024-10075 · Typogrify · Typogrify

Name of the Vulnerable Software and Affected Versions: Typogrify versions 0.0.0 through 1.3.0 Description: The issue is related to improper neutralization of input during web page generation, which allows for Cross-Site Scripting XSS. This can be exploited by a remote attacker to conduct an XSS...

PT-2023-25109 · WordPress · Password Reset With Code For Wordpress Rest Api

Name of the Vulnerable Software and Affected Versions: Password Reset with Code for WordPress REST API versions 0.0.0 through 0.0.15 Description: The issue is related to an Improper Restriction of Excessive Authentication Attempts vulnerability in the Password Reset with Code for WordPress REST...

Malicious code in data-type-public (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 90c26075e74ebc9cae6a492f997974105a4951be23a89236c7e84a0a9e169933 The OpenSSF Package Analysis project identified 'data-type-public' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

PT-2023-24019

Name of the Vulnerable Software and Affected Versions Langchain versions 0.0.0 through 0.0.155 Langchain versions prior to 0.0.329 Description The issue allows an attacker to force the service to retrieve data from an arbitrary URL, essentially providing Server-Side Request Forgery SSRF and...

PT-2023-24637 · Unknown · Rakib Hasan Dynamic Qr Code Generator

Name of the Vulnerable Software and Affected Versions: Rakib Hasan Dynamic QR Code Generator plugin versions 0.0.0 through 0.0.5 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This means that an attacker can inject malicious scripts into the...

Duplicate Advisory: @excalidraw/excalidraw Cross-site Scripting vulnerability

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-v7v8-gjv7-ffmr. This link is maintained to preserve external references. Original Description Versions of the package @excalidraw/excalidraw from 0.0.0 are vulnerable to Cross-site Scripting XSS via embedded lin...