PT-2019-1106 · Npm +6 · Npm +6

Name of the Vulnerable Software and Affected Versions: npm CLI versions prior to 6.13.3 Description: The issue is related to errors in link handling in the npm and Yarn package managers. Exploitation of this issue may allow a remote attacker to write arbitrary files by creating a symbolic link to...

Malicious Package

pizza-pasta is a malicious package. The package contains malicious code existing as install scripts. The package created folders in the system's Desktop and downloaded an image from imgur.com. The package also printed the users SSH keys to the console...

Roundcube Webmail <= 1.3.4 Insecure Permissions Vulnerability

Roundcube Webmail is prone to an insecure permissions vulnerability. Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...

Malicious Package

angluar-cli is a malicious package. It contains malicious codes in its post-install scripts which attempt to remove files and stop processes related to McAfee antivirus on macOS...

Malicious Package

font-scrubber is a malicious package. It contains malicious codes in its post-install scripts, attempting to upload sensitive files including configuration files, command history logs, SSH keys and /etc/passwd to a remote server...

npm Token Leak in npm

Affected versions of the npm package include the bearer token of the logged in user in every request made by the CLI, even if the request is not directed towards the user's active registry. An attacker could create an HTTP server to collect tokens, and by various means including but not limited t...

instack-undercloud: uses hardcoded /tmp paths

A flaw was found in instack-undercloud where pre-install and security policy scripts used insecure temporary files. A local user could exploit this flaw to conduct a symbolic-link attack, allowing them to overwrite the contents of arbitrary files...

npm Token Leak

Overview Affected versions of the npm package include the bearer token of the logged in user in every request made by the CLI, even if the request is not directed towards the user's active registry. An attacker could create an HTTP server to collect tokens, and by various means including but not...

OracleVM 2.1 : kernel (OVMSA-2008-2009)

The remote OracleVM system is missing necessary patches to address critical security updates : - Update post install scripts to properly set default boot kernel. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. The package checks in this plugin were extracted from OracleVM Security Advisory...

CVE-2004-1228: Undefined Security Weakness

The install scripts in SugarCRM Sugar Sales 2.0.1c and earlier are not removed after installation, which allows attackers to obtain the MySQL administrative password in cleartext from an installation form, or to cause a denial of service by changing database settings to the default...