MAL-2025-29274 Malicious code in pinnacle-brook-njr948-project (npm)

The package pinnacle-brook-njr948-project was found to contain malicious code...

MAL-2025-16194 Malicious code in brook-peony-luh099-project (npm)

The package brook-peony-luh099-project was found to contain malicious code...

MAL-2025-16189 Malicious code in brook-glade-zuv167-project (npm)

The package brook-glade-zuv167-project was found to contain malicious code...

MAL-2025-18212 Malicious code in delta-brook-hvf934-project (npm)

The package delta-brook-hvf934-project was found to contain malicious code...

MAL-2025-40033 Malicious code in xylophone-brook-uti375-project (npm)

The package xylophone-brook-uti375-project was found to contain malicious code...

MAL-2025-16188 Malicious code in brook-galaxy-jxr850-project (npm)

The package brook-galaxy-jxr850-project was found to contain malicious code...

MAL-2025-37302 Malicious code in tundra-brook-ots726-project (npm)

The package tundra-brook-ots726-project was found to contain malicious code...

MAL-2025-23533 Malicious code in jacket-brook-cim504-project (npm)

The package jacket-brook-cim504-project was found to contain malicious code...

MAL-2025-16196 Malicious code in brook-whirlpool-nir965-project (npm)

The package brook-whirlpool-nir965-project was found to contain malicious code...

MAL-2025-16193 Malicious code in brook-lightning-cto460-project (npm)

The package brook-lightning-cto460-project was found to contain malicious code...

CVE-2024-51692

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in askewbrook Bing Search API Integration abbs-bing-search allows Reflected XSS.This issue affects Bing Search API Integration: from n/a through = 0.3.3...

CVE-2024-51692

CVE-2024-51692 (Bing Search API Integration, WordPress) is a reflected XSS vulnerability in the Bing Search API Integration plugin (Askew Brook) that could allow an attacker to inject and execute script during page generation. It affects the plugin version range from earlier releases up to 0.3.3....

PT-2024-34839

Name of the Vulnerable Software and Affected Versions Askew Brook Bing Search API Integration versions 0.3.3 and earlier Description The issue is related to improper neutralization of input during web page generation, leading to a Cross-site Scripting XSS vulnerability, specifically Reflected XSS...

linguistics.stonybrook.edu Cross Site Scripting vulnerability OBB-3890003

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

stonybrook.edu Cross Site Scripting vulnerability OBB-3782529

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

stonybrook.edu Cross Site Scripting vulnerability OBB-3731869

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Command Injection

github.com/txthinking/brook is vulnerable to Command Injection. The vulnerability exists due to a lack of user request validation in the local tproxy service, which allows an attacker to inject and execute arbitrary commands...

GHSA-VFRJ-FV6P-3CPF Brook's tproxy server is vulnerable to a drive-by command injection.

The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution...

CVE-2023-33965

Brook is a cross-platform programmable network tool. The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution. A patch is available in...

Command injection

Brook is a cross-platform programmable network tool. The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution. A patch is available in...