Malicious code in @zalastax/nolb-aim (npm)

The package @zalastax/nolb-aim was found to contain malicious code...

Cross-site Scripting (XSS)

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /api/reports endpoint, which processes user-submitted Python code that is interpreted and executed by the function pyodide.code.runjs...

Directory Traversal

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Directory Traversal in the LockManager.releaselocks function. An attacker can delete arbitrary files on the filesystem by passing an absolute path to the target file ...

External Control of File Name or Path

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to External Control of File Name or Path via the restorerunbackup function. An attacker can write arbitrary data to arbitrary locations on the host server by controlling...

Denial of Service (DoS)

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Denial of Service DoS by sending a large number of requests to retrieve tracked metrics simultaneously. This excessive load results in uncontrolled resource consumpti...

Cross-site Request Forgery (CSRF)

Overview aim is a super-easy way to record, search and compare AI experiments. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to overly permissive CORS settings that allow cross-origin requests from all origins. An attacker can manipulate the state of the...

Malicious code in sap-aim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 244887dfb793a534f8315571ac4ce6a3f97aa3a4177470d47fd5ce38563548e6 The OpenSSF Package Analysis project identified 'sap-aim' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicat...

MAL-2024-7527 Malicious code in sap-aim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 244887dfb793a534f8315571ac4ce6a3f97aa3a4177470d47fd5ce38563548e6 The OpenSSF Package Analysis project identified 'sap-aim' @ 0.0.0 npm as malicious. It is considered malicious because: - The package communicat...