Malicious code in react-nati0e-vecor-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e0e350c78d225cd75ed5e2ca0291e0d192e6892797c1a7a61c762bfcb2fe39e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5655 Malicious code in react-nati0e-vecor-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e0e350c78d225cd75ed5e2ca0291e0d192e6892797c1a7a61c762bfcb2fe39e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in deere-ui-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4872d39ec3fd4c04d5d042ba001480f7e3d8cc24fe7f7e8b5951300aa6ddfd3f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview deere-ui-icons is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious code in waffles-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1844bfb21f9898d69137bb315c2e9bfb2b07a27b55a5c8962b152f8df216f980 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-7030 Malicious code in waffles-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1844bfb21f9898d69137bb315c2e9bfb2b07a27b55a5c8962b152f8df216f980 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in icons-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca53637ebcf9b69a19876fca2cec6a417f55c18845d4019edd17d8e3ab2e29b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3759 Malicious code in icons-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83ba92fd048a472e3cb8fd55e322eed6b9fbe9f052cf6750b9c24a34e67c85da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5175 Malicious code in pack-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be9ec3c538d6a4cbaf75081c6996c9c6bdae7ff861aae544eec2b9fd02162de0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3757 Malicious code in icons-pack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca53637ebcf9b69a19876fca2cec6a417f55c18845d4019edd17d8e3ab2e29b8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in icons-packages (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83ba92fd048a472e3cb8fd55e322eed6b9fbe9f052cf6750b9c24a34e67c85da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pack-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be9ec3c538d6a4cbaf75081c6996c9c6bdae7ff861aae544eec2b9fd02162de0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.340, symbol-based icons unescape previously escaped values of tooltip parameters. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescap...

GHSA-MHP7-3393-PFQR Cross-site Scripting vulnerability in Jenkins

Since Jenkins 2.340, symbol-based icons unescape previously escaped values of tooltip parameters. This vulnerability is known to be exploitable by attackers with Job/Configure permission. Jenkins 2.356, LTS 2.332.4 and LTS 2.346.1 addresses this vulnerability. Symbol-based icons no longer unescap...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

Cross site scripting

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...

CVE-2022-34172

In Jenkins 2.340 through 2.355 both inclusive symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting XSS vulnerability...

Malicious Package

Overview @tamagoshi/icons is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

CVE-2022-34172

In Jenkins 2.340 through 2.355 both inclusive symbol-based icons unescape previously escaped values of 'tooltip' parameters, resulting in a cross-site scripting XSS vulnerability...

CVE-2022-34171

In Jenkins 2.321 through 2.355 both inclusive and LTS 2.332.1 through LTS 2.332.3 both inclusive the HTML output generated for new symbol-based SVG icons includes the 'title' attribute of 'l:ionicon' until Jenkins 2.334 and 'alt' attribute of 'l:icon' since Jenkins 2.335 without further escaping,...