MAL-2024-7488 Malicious code in sap-action2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3a7074778f420cd6e72cd47c261e9d9628b1b4257940eb2224ba02a924ed3706 The OpenSSF Package Analysis project identified 'sap-action2' @ 0.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in secnav (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a9e8a7599691831cd3f6a1111dfd17e5b50219d9eabcfffa1ff08edb10be6d8c The OpenSSF Package Analysis project identified 'secnav' @ 69.69.69 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7438 Malicious code in eslint-plugin-ally-rules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 23310826a7310567370020e364d6dedeb87558d2ce0ffcf5bc6054d70951bf3c The OpenSSF Package Analysis project identified 'eslint-plugin-ally-rules' @ 1.0.5 npm as malicious. It is considered malicious because: - The...

Malicious code in job-specs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 33cc6191f6fbd8274e7eb5fe159654ded5d7fadbdc6fe26dbb62b26c0ddd42ed The OpenSSF Package Analysis project identified 'job-specs' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in aroly-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5559e3338ab9d433fec892063a5f0ec5ac1164490196c5a095bc2ffb723e6290 The OpenSSF Package Analysis project identified 'aroly-test' @ 1.0.10 npm as malicious. It is considered malicious because: - The package...

CVE-2024-31316

In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-31316

In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-31316

In onResult of AccountManagerService.java, there is a possible way to perform an arbitrary background activity launch due to parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

WordPress User Activity Log Pro plugin <= 2.3.4 - Subscriber+ Multiple Broken Access Control vulnerability

Subscriber+ Multiple Broken Access Control vulnerability discovered by Dave Jong Patchstack in WordPress Plugin User Activity Log Pro versions = 2.3.4...

PT-2024-23964 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions affected versions not specified Description: The issue is related to a parcel mismatch in the onResult method of AccountManagerService.java, which could allow an arbitrary background activity launch. This could lead to local...

VulnCheck KEV: CVE-2024-37929

Missing Authorization vulnerability in solwin User Activity Log Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Activity Log Pro: from n/a through 2.3.4...

WordPress User Activity Log Pro Plugin <= 2.3.4 is vulnerable to Broken Access Control

Software User Activity Log Pro Type Plugin Vulnerable versions = 2.3.4 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37929 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID a51ba27e9212 Credits Dave Jong Patchstac...

kernel: mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update

In the Linux kernel, the following vulnerability has been resolved: mlxsw: spectrumacltcam: Fix possible use-after-free during activity update The Linux kernel CVE team has assigned CVE-2024-35855 to this issue. Upstream advisory:...

Malicious code in fake-package-agpl-license (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 53470e96107ebc806b1a440821244a335389aca112b5752ce995ae87150b0b4d The OpenSSF Package Analysis project identified 'fake-package-agpl-license' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-7425 Malicious code in fake-package-apache-with-copyleft-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dccffa1d5f84a8476d98fd5eed5c0401aba753ef0916b506d1b8f9687029351d The OpenSSF Package Analysis project identified 'fake-package-apache-with-copyleft-dep' @ 4.0.0 npm as malicious. It is considered malicious...

MAL-2024-7422 Malicious code in genaiscript-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bb751d77363fdcebae7c4876de9a26b85a29be3677d2de516fb1c4e9cfd244c1 The OpenSSF Package Analysis project identified 'genaiscript-core' @ 0.4.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-7421 Malicious code in branch-deploy-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6f8ee439aa1b1732d638e3b68c12f320056784b39327753fbd3ff9f476d39ace The OpenSSF Package Analysis project identified 'branch-deploy-action' @ 2.1.1 npm as malicious. It is considered malicious because: - The packa...

MAL-2024-7418 Malicious code in react-devtools-fusebox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 023ce7599294ef47cf0b24d7424bada9cfa75c0c3ac1f94d0a2a23e0e4f55d6b The OpenSSF Package Analysis project identified 'react-devtools-fusebox' @ 2.1.1 npm as malicious. It is considered malicious because: - The...

CVE-2024-39687

Fedify is a TypeScript library for building federated server apps powered by ActivityPub and other standards. At present, when Fedify needs to retrieve an object or activity from a remote activitypub server, it makes a HTTP request to the @id or other resources present within the activity it has...

MAL-2024-7092 Malicious code in addcriteria (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c8a650259b91088a362b09e041392896460946359bcf0b040ffed50c24de11a2 The OpenSSF Package Analysis project identified 'addcriteria' @ 69.69.69 npm as malicious. It is considered malicious because: - The package...