Malicious code in headless-obyte (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23a746248cdd3fa9fc000729a31a09edc3476b4ad4cbdec19c121fb0ca07fb77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3583 Malicious code in headless-obyte (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23a746248cdd3fa9fc000729a31a09edc3476b4ad4cbdec19c121fb0ca07fb77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview headless-obyte is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

New YTStealer Malware Aims to Hijack Accounts of YouTube Content Creators

Cybersecurity researchers have documented a new information-stealing malware that targets YouTube content creators by plundering their authentication cookies. Dubbed "YTStealer" by Intezer, the malicious tool is likely believed to be sold as a service on the dark web, with it distributed using fa...

Remote Code Injection

Overview convert-svg-core is a package that supports converting SVG into another format using headless Chromium. Affected versions of this package are vulnerable to Remote Code Injection via sending an SVG file containing the payload. PoC: js const convert = require'convert-svg-to-png'; const...

Github saleor安全漏洞

Github saleor is a headless GraphQL commerce platform that delivers a super-fast, dynamic, personalized shopping experience. Beautiful online store, anywhere, on any device. A security vulnerability exists in saleor versions prior to 3.1.2 that stems from incorrect authorization in the applicatio...

SUSE: Security Advisory (SUSE-SU-2022:0784-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2021-25985

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25985

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25983

In Factor App Framework & Headless CMS forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

Cross site scripting

In Factor App Framework & Headless CMS forum plugin, versions v1.3.8 to v1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “tags” and “category” parameters in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

Cross site scripting

In Factor App Framework & Headless CMS forum plugin, versions 1.3.5 to 1.8.30, are vulnerable to reflected Cross-Site Scripting XSS at the “search” parameter in the URL. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

Cross site scripting

In Factor App Framework & Headless CMS v1.0.4 to v1.8.30, improperly invalidate a user’s session even after the user logs out of the application. In addition, user sessions are stored in the browser’s local storage, which by default does not have an expiration time. This makes it possible for an...

CVE-2021-25985

In Factor (App Framework & Headless CMS) from v1.0.4 through v1.8.30, the vulnerability stems from improperly invalidating a user session after logout and storing sessions in browser local storage (which has no expiration). This enables an attacker to steal and reuse session data via XSS, potenti...

CVE-2021-25984 FactorJS - Stored Cross-Site Scripting (XSS) in Post Reply Functionality

In Factor App Framework & Headless CMS forum plugin, versions v1.3.3 to v1.8.30, are vulnerable to stored Cross-Site Scripting XSS at the “post reply” section. An unauthenticated attacker can execute malicious JavaScript code and steal the session cookies...

Crawlergo - A Powerful Browser Crawler For Web Vulnerability Scanners

crawlergo is a browser crawler that uses chrome headless mode for URL collection. It hooks key positions of the whole web page with DOM rendering stage, automatically fills and submits forms, with intelligent JS event triggering, and collects as many entries exposed by the website as possible. Th...

a-cv-imwrite-imread-plus (=0.12.0), aana (>=0.2.1 <=0.2.4) +3127 more potentially affected by CVE-2019-5064 via opencv-python-headless (>=3.4.3.18 <=4.1.2.30)

opencv-python-headless PYPI version =3.4.3.18, =0.2.1, =1.0.0, =0.17.3, =0.0.1.44, =0.0.1, =0.0.1, =0.2.1, =0.2.0, =0.3.0, =0.1.0, =0.1.2 and more Source cves: CVE-2019-5064 Source advisory: OSV:GHSA-Q799-Q27X-VP7W...

ailabeler (=0.5.0), aiotieba (>=2.9.0 <=2.9.1) +117 more potentially affected by CVE-2019-5064 via opencv-contrib-python-headless (>=3.4.18.65 <=4.1.2.30)

opencv-contrib-python-headless PYPI version =3.4.18.65, =2.9.0, =0.1.0, =1.2.0, =0.1.0, =0.1.11, =1.0.0, =5.4.1, =0.1.9, =0.1.1, =0.1.2, =0.19.0, =0.20.0 and more Source cves: CVE-2019-5064 Source advisory: OSV:GHSA-Q799-Q27X-VP7W...

ailabeler (=0.5.0), aiotieba (>=2.9.0 <=2.9.1) +117 more potentially affected by CVE-2019-5063 via opencv-contrib-python-headless (>=3.4.18.65 <=4.1.0.25)

opencv-contrib-python-headless PYPI version =3.4.18.65, =2.9.0, =0.1.0, =1.2.0, =0.1.0, =0.1.11, =1.0.0, =5.4.1, =0.1.9, =0.1.1, =0.1.2, =0.19.0, =0.20.0 and more Source cves: CVE-2019-5063 Source advisory: OSV:GHSA-M6VM-8G8V-XFJH...

a-cv-imwrite-imread-plus (=0.12.0), aana (>=0.2.1 <=0.2.4) +3127 more potentially affected by CVE-2019-5063 via opencv-python-headless (>=3.4.3.18 <=4.1.0.25)

opencv-python-headless PYPI version =3.4.3.18, =0.2.1, =1.0.0, =0.17.3, =0.0.1.44, =0.0.1, =0.0.1, =0.2.1, =0.2.0, =0.3.0, =0.1.0, =0.1.2 and more Source cves: CVE-2019-5063 Source advisory: OSV:GHSA-M6VM-8G8V-XFJH...