13179 matches found
CVE-2025-60699
A buffer overflow vulnerability exists in the TOTOLINK A950RG Router firmware V5.9c.4592B20191022ALL within the global.so binary. The getSaveConfig function retrieves the httphost parameter from user input via websGetVar and copies it into a fixed-size stack buffer v13 using strcpy without...
CVE-2025-64726 External Control of System or Configuration Setting and Uncontrolled Search Path Element in sfw
Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Firewall binary versions separate from installers prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project...
CVE-2025-64726 External Control of System or Configuration Setting and Uncontrolled Search Path Element in sfw
Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Firewall binary versions separate from installers prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project...
CVE-2025-64726
Socket Firewall (sfw) is affected for binary versions prior to 0.15.5. The vulnerability allows arbitrary code execution when run in an untrusted project directory by placing a malicious .sfw.config; loading the file populates environment variables into the Node.js process, enabling an attacker t...
EUVD-2025-175357
Socket Firewall is an HTTP/HTTPS proxy server that intercepts package manager requests and enforces security policies by blocking dangerous packages. Socket Firewall binary versions separate from installers prior to 0.15.5 are vulnerable to arbitrary code execution when run in untrusted project...
Prototype Pollution
spmrc is vulnerable to Prototype Pollution. The vulnerability is due to improper input validation in the set and config functions, which allows an attacker to supply a crafted payload to inject properties on Object.prototype, leading to denial of service DoS or other unexpected behaviors...
EUVD-2025-175971
Malicious code in tethys-deimos-spinner-eslint-config npm...
Malicious code in hermes-config-unuk-aurora (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be45cfa8332efa48889c39ea7acf947b99ce9fc254f407db0c6e462ae8de03c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178539
Malicious code in hermes-config-unuk-aurora npm...
EUVD-2025-175792
Malicious code in upgrade-dysonswarm-node-config-got npm...
EUVD-2025-179601
Malicious code in config-xml-sirius-config npm...
EUVD-2025-177572
Malicious code in node-config-private-zenobia-perseus npm...
EUVD-2025-177575
Malicious code in node-config-lynx-cressida-hermes npm...
Malicious code in cross-env-dorado-eslint-config-zephyr (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0985a4ef455f65277df5cbe81f64d7157822a1f417ec13d808b81967e4ce8e28 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in commitlint-config-angular-nodejs-carpo-vortex (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aff6171864c8dd888f734cabf61ae22f26f3868044dd59eb396032310cdbcf72 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176558
Malicious code in sagitta-polaris-configstore-commitlint-config-angular npm...
EUVD-2025-180372
Malicious code in aquarius-relay-pulsar-eslint-config npm...
EUVD-2025-178911
Malicious code in filament-axios-node-config-jasmine npm...