Django: Django: SQL Injection via RasterField band index parameter

A flaw was found in Django. A remote attacker could inject SQL commands by manipulating the band index parameter during raster lookups on RasterField only implemented on PostGIS. This SQL injection vulnerability could lead to unauthorized information disclosure, data alteration, or denial of...

Johnson Controls Metasys Products

RISK EVALUATION Successful exploitation of this vulnerability could result in remote SQL execution, leading to alteration or loss of data. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network...

CVE-2021-2474

Vulnerability in the Oracle Web Analytics product of Oracle E-Business Suite component: Admin. Supported versions that are affected are 12.1.1-12.1.3. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Web Analytics. Successful attack...

CVE-2025-40804

A vulnerability has been identified in SIMATIC Virtualization as a Service SIVaaS All versions. The affected application exposes a network share without any authentication. This could allow an attacker to access or alter sensitive data without proper authorization...

CVE-2022-27803

Improper input validation vulnerability in Space of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Space...

CVE-2022-27661

Operation restriction bypass vulnerability in Workflow of Cybozu Garoon 4.0.0 to 5.5.1 allows a remote authenticated attacker to alter the data of Workflow...

CVE-2019-7889

An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data o...

Rockwell Automation Verve Asset Manager

RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker accessing or altering user data. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all...

Malicious code in csrf-thermochronology-oscillation-janus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23992ff1d63ebb87f14b33af1af9f888a76886aea879d7893bbf8d971fb1fa92 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185402 Malicious code in air-minify-load-secure-encode (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1af3ec54197cb7da3f25eb9bd335126dffc771d242e1a8159a7354d5522b5442 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in diva-tugafai-imagiuaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ec7ffb52586e8d85d9ed70d0d4f919689a02f5ac656a9d5248427a454243623 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176858 Malicious code in nuilva-vmiam-bunamab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3dd08418eeaad14cae815becb115c3e0973f8799da2d8271da13fd83bd459e8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150082 Malicious code in @mipta1/iyuglk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d31e1024c003a1257f877dd0f043ab7f136693e35a48fefdea388993b6c3f6d7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in musnisdr-nuyt-musast (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0eca39f3f5d5439c1e26d425ea03d1949b1b4b6095f366d33b837e5577c0af5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in uinsu-losiat-dik (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 607ca40db9617286de4a68e351a23476a220b1a8e9bcd8dbae69e454b045cfa1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163759 Malicious code in nudela-fofgaf-gafsaoai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 149d11d07cb42c44c68724b356625f894e19c1785420c8ad147d4d9b5d351132 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163061 Malicious code in nokire-namiresan11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a160842026bf01ee11d36662ecce79c2a4972a0a1e6f5bf1e0e3fcf3e4377375 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-150966 Malicious code in @miptaa02/tdisd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf9e4547d7b4a329f876d3a879e197a812c99ffa7dae5be034cd90967e281f1a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-151582 Malicious code in abuh-poke22 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57d6f8e44d1a68d959a0802ebf0ffece5da4ec196d0f957ac11bca0c4f7aa9d4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bunyan-canopus-kinetic-carpo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d539cc7eb5c8f4faa4c7935908582514a5cabc02edcf4ca728eabe1cba80e500 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...