External Control of Assumed-Immutable Web Parameter

Overview sylius/paypal-plugin is a PayPal plugin for Sylius. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter. The user-input payment amount is not adequately confirmed to be the same between payment completion and order authorization, in...

Malicious code in tasks_mangement (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5af70a269afd5435306a85b902070f929d511d8855e369cc7c930a9dc50be50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

External Control of Assumed-Immutable Web Parameter

Overview sylius/paypal-plugin is a PayPal plugin for Sylius. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter. The user-input payment amount is not adequately confirmed to be the same between initial entry and payment completion, in...

CVE-2023-45588

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2023-45588

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2025-24996

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

Malicious code in smart-power-strip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1cc33c4b430e08bef89e4f67199d79002235613631ee986f8566d757fc14ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2379 Malicious code in elementor-editor-github-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72f60b6d3f909084d15e59acc80082db35f713c520dc29ff74ec2a79ceb33dcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dvd-ai-pc-rag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a767db3d0d8194ea0442ea2138060477dfc8356ba986a5e7a707145af45d9427 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in events-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab45d10dfa09f0ea69e25ef62c978634d9b929402d3875a2687180c005723eca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm-testlist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 719312e2aaf577f4308c89250b75cd26b241aa1e8e15fa6f3eb9392d5a7a67d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chialisp-lsp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeede289ccdfe7d4487e01b4eb54ed16a8666295df50031d9369d92f75d0d51e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-24996

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-24054

CVE-2025-24054 is a Windows NTLM vulnerability allowing an attacker to induce NTLMv2-SSP hash disclosure by leveraging explorer.exe to fetch remote SMB resources via crafted file types (notably .library-ms and .lnk/.library-ms payloads). Public PoCs and exploits demonstrate creating malicious .li...

CVE-2025-24054: External Control of File Name or Path

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

MAL-2025-2181 Malicious code in makerspace-cpx-intro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f001e9f23b801fb8c275858b50785d657d092aac3e06e694490e7e4b5dd0ae1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2081 Malicious code in @roku-web-ui/legacy-styleguide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64351a60460f32a078a6792ac73191925335220106d05dc9d59eb22c56281b3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sonahri51/orientation-change-end (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4e5ffc2c48c12f6b36620be282c6ed94826d434430e8412d70a220d4719b366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grafana-metricsdrilldown-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76f0bf52430819b26f7b4042daedcdd27b0b6dcc7278385dac6989be16b987de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm-manifest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ade7d6d1c64c23c0b5ce1641cbe6a421ae5e995127affe277b05a6328ef012e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...