Malicious code in amazon-gateway (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f8c3ed9194a70a080c9814645d91c46cf2195692168d2efa5e08e5078a853d91 The OpenSSF Package Analysis project identified 'amazon-gateway' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in amazon-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9680dbff3b7fad0b576b1efae75268c097baf1059dc1238e024598ff9cf77028 The OpenSSF Package Analysis project identified 'amazon-payment' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in amazon-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ca95e83b37fb0ea358d6155d8158d873558f75026d3e1b8304456522fafc7755 The OpenSSF Package Analysis project identified 'amazon-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

WordPress plugin Activity Plus Reloaded for BuddyPress: Code issues and vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A code issue vulnerability exists in the...

CVE-2024-11913: Server-Side Request Forgery (SSRF)

The Activity Plus Reloaded for BuddyPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.1 via the 'ajaxpreviewlink' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web...

PT-2025-1712

Name of the Vulnerable Software and Affected Versions Activity Plus Reloaded for BuddyPress plugin for WordPress versions 1.1.1 and earlier Description The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the...

Malicious code in airbnb-api-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5dbe417775cdf936de0b309b6f15596072d0e6111399a3f24d499f98f0fde022 The OpenSSF Package Analysis project identified 'airbnb-api-client' @ 999.9.9 npm as malicious. It is considered malicious because: - The packag...

Malicious code in airbnb-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 569af68d5b2f70cc46c62d3be362723205c02819f13c60a456a6925c2f6d1dd2 The OpenSSF Package Analysis project identified 'airbnb-auth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in airbnb-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 302f06ee50a543ce401bd2fd81e36ce6491cfbcf2c0d900eb19e3768f4946098 The OpenSSF Package Analysis project identified 'airbnb-analytics' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-359 Malicious code in collapsible-group (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0a424d4fcd62d35f9e9da962931dbc5fd39e9bfc3b4744a5f00c5e442b2ddb36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-23540

creationtimestamp| type| source ---|---|--- 2025-01-23 15:30:12+00:00| seen| https://infosec.exchange/users/cve/statuses/113878382152309201 2025-01-23 15:34:56+00:00| seen| https://infosec.exchange/users/cve/statuses/113878400792489848 2025-01-23 16:16:13+00:00| seen|...

CVE-2025-23966

creationtimestamp| type| source ---|---|--- 2025-01-22 15:21:56+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgdoawnq7e2f 2025-01-22 15:49:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lgdpspxwwf2i 2025-01-22 17:13:27+00:00| seen|...

CVE-2024-49742

In onCreate of NotificationAccessConfirmationActivity.java , there is a possible way to hide an app with notification access in Settings due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed f...

CVE-2024-49737

In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities as the system UID due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

Malicious code in react-native-apollo-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 643d99775fbe5d1e11235967329b1d9bfdd5f173b113db79c998b0ea7f2b7b3c The OpenSSF Package Analysis project identified 'react-native-apollo-devtools' @ 1.0.0 npm as malicious. It is considered malicious because: - T...

Malicious code in @moneyguide-devkit/style-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8d41e363cb9b67e73c6cfe2f5b71641d9289a57d80051c4e3e67b22db36574d8 The OpenSSF Package Analysis project identified '@moneyguide-devkit/style-provider' @ 1.0.1 npm as malicious. It is considered malicious because...

CVE-2025-21643

creationtimestamp| type| source ---|---|--- 2025-01-19 10:58:27+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/2323 2025-01-19 11:12:07+00:00| seen| https://infosec.exchange/users/cve/statuses/113854718095653986 2025-01-19 11:15:52+00:00| seen|...

Malicious code in dbximgs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3a752546905d1373f7b092a98454b7ca4e820bebecb1af358ce0a6a72fa9a1e8 The OpenSSF Package Analysis project identified 'dbximgs' @ 2.0.0 npm as malicious. It is considered malicious because: - The package communicat...

MAL-2025-133 Malicious code in tagmyphotosblog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 68718b8c6a0e78b22dbddaeb5a6be69dac34b17d2e20d9a2fdf08d6bbbf95a00 The OpenSSF Package Analysis project identified 'tagmyphotosblog' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in keystone-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d1e499fbcaddce6bdea8ab5e0bf4a301d23b6db8e65cb2647376df41c9850cb2 The OpenSSF Package Analysis project identified 'keystone-app' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...