Malicious Package

Overview dash-generator-test-component-standard is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only...

Malicious code in dash-generator-test-component-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 589f8997367b0fcf74898b358292237c8ec3c807c1785b8564ba195b6ac5d2af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6749 Malicious code in ui-dash-commons-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bad92b6a151837959646c064223494d282ed529116aeff99aa3451c34237d3ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4742 Malicious code in mwembed-dash-everywhere (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b564441937b7693ebbf08a6d629cfb0eb246e7be18bcf10818964d72f26892c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mwembed-dash-everywhere (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b564441937b7693ebbf08a6d629cfb0eb246e7be18bcf10818964d72f26892c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

WordPress Icegram plugin <= 2.1.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Pritam Dash in WordPress Icegram plugin versions = 2.1.7. Solution Update the WordPress Icegram plugin to the latest available version at least 2.1.8...

Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117...

GHSA-JJXG-HPM7-G95F Bazaar allows remote attackers to execute arbitrary commands via a bzr+ssh URL with initial dash character in hostname

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname, a related issue to CVE-2017-9800, CVE-2017-12836, CVE-2017-12976, CVE-2017-16228, CVE-2017-1000116, and CVE-2017-1000117...

PT-2022-2574 · Bundler +1 · Bundler +1

Name of the Vulnerable Software and Affected Versions: RubyGems.org affected versions not specified Description: The issue is related to a bug in the yank action of RubyGems.org, allowing any user to remove and replace certain gems without authorization. A gem is vulnerable if it has one or more...

CVE-2022-29904

The SemanticDrilldown extension for MediaWiki through 1.37.2 before e688bdba6434591b5dff689a45e4d53459954773 allows SQL injection with certain '-' and '' constraints...

MediaWiki SQL注入漏洞

MediaWiki is a set of web-based wiki engines from the U.S. Wikimedia MediaWiki Foundation. The product can be used to deploy internal knowledge management and content management systems. A security vulnerability exists in MediaWiki version 1.37.2 and earlier, which stems from a SemanticDrilldown...

The vulnerability of the gf_dashSegmenter_probe_input function in the MP4Box module of the GPAC multimedia platform allows a intruder to cause a service failure.

The vulnerability of the gfdashsegmenterprobeinput function in the MP4Box component of the GPAC multimedia platform is related to pointer assignment errors. Exploiting this vulnerability allows a remote attacker to trigger a service failure using a specially created file...

AZL-9068 CVE-2021-20257 affecting package qemu for versions less than 6.2.0-2

An infinite loop flaw was found in the e1000 NIC emulator of the QEMU. This issue occurs while processing transmits tx descriptors in processtxdesc if various descriptor fields are initialized with invalid values. This flaw allows a guest to consume CPU cycles on the host, resulting in a denial o...

WordPress Go Dash – Makes Your Dashboard Fast plugin <= 1.0.4 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Go Dash – Makes Your Dashboard Fast plugin versions = 1.0.4. Solution No patched version available...

WordPress Go Dash – Makes Your Dashboard Fast plugin <= 1.0.4 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Go Dash – Makes Your Dashboard Fast plugin versions = 1.0.4. Solution No patched version available...

Prototype pollution in min-dash

Impact The set method is vulnerable to prototype pollution with specially crafted inputs. javascript // insert the following into poc.js and run node poc,js after installing the package let parser = require"min-dash"; parser.set, "proto", "polluted", "success"; console.logpolluted; Patches...

GHSA-2M53-83F3-562J Prototype pollution in min-dash

Impact The set method is vulnerable to prototype pollution with specially crafted inputs. javascript // insert the following into poc.js and run node poc,js after installing the package let parser = require"min-dash"; parser.set, "proto", "polluted", "success"; console.logpolluted; Patches...

@hbtgmbh/dmn-eval-js (>=1.4.0 <=1.5.0), @hbtgmbh/dmn-server (>=1.0.0 <=1.0.2) +33 more potentially affected by CVE-2021-23460 via min-dash (>=1.1.0 <=3.5.2)

min-dash NPM version =1.1.0, =1.4.0, =1.0.0, =0.16.0, =1.0.105, =1.0.0, =1.0.33, =1.0.1, =0.28.0, =0.1.0, =3.0.0, =1.0.0, =0.2.0, =0.11.0, =3.0.0, =4.0.0 and more Source cves: CVE-2021-23460 Source advisory: OSV:GHSA-2M53-83F3-562J...

Mageia: Security Advisory (MGASA-2021-0006)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

GHSA-FM93-FHH2-CG2C Duplicate Advisory: Prototype Pollution in min-dash

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-2m53-83f3-562j. This link is maintained to preserve external references. Original Description The package min-dash before 3.8.1 are vulnerable to Prototype Pollution via the set method due to missing enforcement...