Axios Security Vulnerabilities

Axios is an HTTP client based on Promise a solution for asynchronous programming. A security vulnerability exists in Axios version 1.5.1, which stems from the presence of a sensitive information disclosure vulnerability...

CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

CVE-2023-45857

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information...

PT-2023-8832

Name of the Vulnerable Software and Affected Versions Axios versions 0.8.1 through 1.5.1 Description The issue is related to a JavaScript library and involves a cross-site request forgery vulnerability. This vulnerability can allow a remote attacker to gain unauthorized access to the XSRF-TOKEN...

MAL-2023-21 Malicious code in @12build/product-api-ts-axios-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 336e30b4abb921976acb4a16517a2a6f2ad668fafe7e41d16b63dbba221feaa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @12build/product-api-ts-axios-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 336e30b4abb921976acb4a16517a2a6f2ad668fafe7e41d16b63dbba221feaa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @12build/account-api-ts-axios-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc5c5465a393a23f776128754b0543c03787f78e563b7142645453e912068ff6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-116 Malicious code in axios-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfa011a32b794f2ee2f8c15b4e213a3034ba5c4e87e82b4df13d9e1b82cc4d10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in axios-proxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dfa011a32b794f2ee2f8c15b4e213a3034ba5c4e87e82b4df13d9e1b82cc4d10 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-J3RG-3RGM-537H Directus vulnerable to Server-Side Request Forgery On File Import

Summary Directus versions =9.22.4 is vulnerable to Server-Side Request Forgery SSRF when importing a file from a remote web server POST to /files/import. An attacker can bypass the security controls that were implemented to patch vulnerability CVE-2022-23080 by performing a DNS rebinding attack a...

MAL-2023-7994 Malicious code in @pagseguro/axios-instance (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a465c79cb8dc5ed82a72b242444916efda5a4f4db9bdd4a28c24b6a7994d350b Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Security Bulletin: Vulnerability in Axios affects IBM Process Mining . CVE-2022-1214

Summary There is a vulnerability in Axios that could allow a remote authenticated attacker to obtain sensitive information. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2022-1214...

Security Bulletin: Vulnerability in Axios affects IBM Process Mining . IBM X-Force ID: 232247

Summary There is a vulnerability in Axios that could allow a remote attacker to obtain sensitive information. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details IBM X-Force ID: 232247 DESCRIPTION: axios...

Security Bulletin: Multiple vulnerabilities affect IBM Sterling External Authentication Server

Summary Multiple vulnerabilities affect IBM Sterling External Authentication Server. These vulnerabilities have been addressed in the latest iFix. Vulnerability Details CVEID:CVE-2021-33502 DESCRIPTION: Node.js normalize-url module is vulnerable to a denial of service, caused by a ReDoS regular...

Malicious code in trin-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c688fcdf2c39715948564637a0d7d3316ced81c6399d928a7a8ec0c333c5f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6651 Malicious code in trin-axios (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c688fcdf2c39715948564637a0d7d3316ced81c6399d928a7a8ec0c333c5f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: App Connect Professional is affected by axios vulnerability

Summary App Connect Professional have addressed the following vulnerability reported in axios. Vulnerability Details IBM X-Force ID: 232247 DESCRIPTION: axios could allow a remote attacker to obtain sensitive information, caused by the leak of sensitive information in the cookie header. By...

Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities

Summary RamdaCVE-2021-42581 is vulnerable to remote attackers to execute arbitrary code on the system, caused by a prototype pollution in functions. An attacker could exploit this vulnerability to execute arbitrary code on the system. Node-forgeCVE-2022-24773, 217313, CVE-2022-24771, CVE-2020-772...

Malicious Package

Overview axios-mock-adapterr is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...