Malicious code in shopify-koa-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 920990d18a9320864de3e853dadcce044cb66b0ddc0a8271c8c9485bd3921b06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6102 Malicious code in shopify-koa-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 920990d18a9320864de3e853dadcce044cb66b0ddc0a8271c8c9485bd3921b06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@aftonbladet/roc-package-web-app-gaea (>=0.1.0 <=0.4.1), roc-package-web-app (>=1.0.0 <=1.0.1) +4 more potentially affected by CVE-2021-23384 via koa-remove-trailing-slashes (=1.0.0)

koa-remove-trailing-slashes NPM version =1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on koa-remove-trailing-slashes and may be impacted: - @aftonbladet/roc-package-web-app-gaea =0.1.0, =1.0.0, =1.0.0-alpha.1, =1.0.0, =1.0.0-alpha.1, =1.0.0-beta5...

Open Redirect in koa-remove-trailing-slashes

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

GHSA-R773-PMW3-F4MR Open Redirect in koa-remove-trailing-slashes

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

Open Redirection

koa-remove-trailing-slashes is vulnerable to open redirection. The usage of relative URLs instead of absolute URLs in removeTrailingSlashes allows an attacker to use trailing double slashes in the URL to redirect users to malicious websites...

GHSA-JQH7-W5PR-CR56 Cross-site scripting in @shopify/koa-shopify-auth

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

Cross-site scripting in @shopify/koa-shopify-auth

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

CVE-2021-23384

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

Open redirect

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

CVE-2021-23384

The package koa-remove-trailing-slashes before 2.0.2 are vulnerable to Open Redirect via the use of trailing double slashes in the URL when accessing the vulnerable endpoint such as https://example.com//attacker.example/. The vulnerable code is in index.js::removeTrailingSlashes, as the web serve...

koa-remove-trailing-slashes 输入验证错误漏洞

koa-remove-trailing-slashes is an application. A Koa middleware that removes trailing slashes from paths. A security vulnerability exists in versions prior to koa-remove-trailing-slashes 2.0.2 that stems from vulnerability to Open Redirect...

@medley/medley (>=0.11.0 <=0.12.1), @nova/azure-functions (>=0.3.0 <=0.3.3) +1 more potentially affected by CVE-2020-7764 via find-my-way (>=2.0.1 <=2.1.0)

find-my-way NPM version =2.0.1, =0.11.0, =0.3.0, =1.0.0, =1.1.0 Source cves: CVE-2020-7764 Source advisory: SNYK:JS-FINDMYWAY-1038269...

GHSA-X45V-PVPG-HCRH Malicious Package in mysql-koa

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

Malicious Package in koa-body-parse

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

GHSA-WQGQ-MFVJ-6QXP Malicious Package in koa-body-parse

This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. Recommendation Remove the package from your environment. There are no indications of further compromise...

cloudcmd (>=5.0.5 <=9.3.2), console-io (>=2.5.2 <=5.0.0) +22 more potentially affected by unknown CVE via ponse (>=1.0.1 <=1.6.1)

ponse NPM version =1.0.1, =5.0.5, =2.5.2, =0.0.0, =0.1.0, =2.7.4, =0.3.0, =1.0.0, =1.0.0, =0.0.1, =0.2.0, =1.0.0, =1.0.0, =1.0.9, =1.0.0, =1.0.0, =1.3.6 and more Source cves: unknown CVE Source advisory: OSV:GHSA-WFHX-6PCM-7M55...

cnpmjs.org (>=2.0.0-beta0 <=2.0.0-rc.3), json2html-cli (>=0.0.2 <=0.0.8) +1 more potentially affected by CVE-2014-10065 via remarkable (=1.3.0)

remarkable NPM version =1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on remarkable and may be impacted: - cnpmjs.org =2.0.0-beta0, =0.0.2, =0.0.8 - koa-markdown =1.0.0 Source cves: CVE-2014-10065 Source advisory: OSV:GHSA-F9VC-Q3HH-QHFV...

CVE-2020-8176

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...

Cross site scripting

A cross-site scripting vulnerability exists in koa-shopify-auth v3.1.61-v3.1.62 that allows an attacker to inject JS payloads into the shop parameter on the /shopify/auth/enablecookies endpoint...