Malicious code in godaddy-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis af949cfb5a5349e6685c85de7c1f23beb51e56c772e2c6f19ec5f00e0a87e407 The OpenSSF Package Analysis project identified 'godaddy-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in epicagames-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e0255f17a95ebab8a2dad34723e65be392d1d7bccd4bc5128ee0450c7ab67639 The OpenSSF Package Analysis project identified 'epicagames-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-448 Malicious code in epicagames-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e0255f17a95ebab8a2dad34723e65be392d1d7bccd4bc5128ee0450c7ab67639 The OpenSSF Package Analysis project identified 'epicagames-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-401 Malicious code in bookingcom-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5c9dcb72053012a554271c8641e9b1e41f0457ce148e0b01794de89c9752b5d5 The OpenSSF Package Analysis project identified 'bookingcom-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in bookingcom-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5c9dcb72053012a554271c8641e9b1e41f0457ce148e0b01794de89c9752b5d5 The OpenSSF Package Analysis project identified 'bookingcom-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-430 Malicious code in dropbox-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ecb4588479d4814adaeee8f5670d6fcdb9fa38e06a48ed99dd6ace3553a4ac24 The OpenSSF Package Analysis project identified 'dropbox-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in dropbox-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ecb4588479d4814adaeee8f5670d6fcdb9fa38e06a48ed99dd6ace3553a4ac24 The OpenSSF Package Analysis project identified 'dropbox-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-383 Malicious code in amazon-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ca95e83b37fb0ea358d6155d8158d873558f75026d3e1b8304456522fafc7755 The OpenSSF Package Analysis project identified 'amazon-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in amazon-model (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ca95e83b37fb0ea358d6155d8158d873558f75026d3e1b8304456522fafc7755 The OpenSSF Package Analysis project identified 'amazon-model' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

PT-2025-4017 · Unknown · Fumiao Opencms

Name of the Vulnerable Software and Affected Versions: fumiao opencms version 2.2 Description: A vulnerability was found in the file /admin/model/addOrUpdate of the component Add Model Management Page. The manipulation of the argument 模板前缀 leads to cross-site scripting. The attack can be initiate...

PT-2025-5414 · Pagelayer · Pagelayer

Name of the Vulnerable Software and Affected Versions: PageLayer versions 1.9.4 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for DOM-Based XSS. This means that an attacker could potentially inject malicious scripts into...

opencms 代码注入漏洞

opencms is a CMS system by fumiao individual developer. A code injection vulnerability exists in opencms version 2.2, which originates from the parameter model in the file /admin/model/addOrUpdate that can lead to cross-site scripting...

Coolify 安全漏洞

Coolify is an open source and self-hosted alternative to Heroku/Netlify/Vercel. coolLabs Coolify suffers from an information disclosure vulnerability that stems from the fact that any authenticated user only needs to know the UUID of the model, which can be exploited by an attacker to obtain the...

The vulnerability of the platform for monitoring, managing, and improving LLM applications, related to deficiencies in access control, allows attackers to gain unauthorized access to protected information and enhance their privileges.

The vulnerability of the platform for monitoring, managing, and improving LLM applications is related to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain unauthorized access to protected information and enhance their privileges...

IBM Engineering Systems Design Rhapsody - Model Manager 7.0.2 < 7.0.2 iFix 32, 7.0.3 < 7.0.3 iFix 10 TOCTOU (7180636)

The version of IBM Engineering Systems Design Rhapsody - Model Manager installed on the remote host is 7.0.2 prior to 7.0.2 ifix 32 or 7.0.3 prior to 7.0.3 ifix 10. It is, therefore, affected by a Time-of-check Time-of-use TOCTOU vulnerability as referenced in the 7180636 advisory. - IBM...

CVE-2024-11147 ECOVACS lawnmowers and vacuums deterministic root password

ECOVACS robot lawnmowers and vacuums use a deterministic root password generated based on model and serial number. An attacker with shell access can login as root...

CVE-2025-23083

A flaw was found in the Node.js diagnosticschannel. This vulnerability allows an attacker to reinstate and misuse worker constructors, potentially bypassing the Permission Model via hooking into events when a worker thread is created...

SUSE CVE-2025-23083

With the aid of the diagnosticschannel utility, an event can be hooked into whenever a worker thread is created. This is not limited only to workers but also exposes internal workers, where an instance of them can be fetched, and its constructor can be grabbed and reinstated for malicious usage...

PT-2025-1627 · Ecovacs · Ecovacs Robot Lawnmowers/Vacuums

Name of the Vulnerable Software and Affected Versions: ECOVACS robot lawnmowers and vacuums affected versions not specified Description: The issue concerns the use of a deterministic root password in ECOVACS robot lawnmowers and vacuums, which is generated based on the model and serial number. An...

Regular expression Denial of Service - ReDoS

Description A Regular Expression Denial of Service ReDoS vulnerability was identified in the Transformers library, specifically in the file tokenizationgptneoxjapanese.py of the GPT-NeoX-Japanese model. The vulnerability occurs in the SubWordJapaneseTokenizer class, where regular expressions...