21 matches found
CVE-2026-44192
CVE-2026-44192 affects the Ansible Lightspeed Model Context Protocol (MCP) server. The vulnerability is a path traversal flaw that can be triggered to manipulate an AI agent via indirect prompt injection, allowing writing of files to unauthorized locations on the user’s system, which may expose s...
Malicious code in @adobesign/as-dev-tools (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6752e4d30c584cb5ca6f67265c983257c1531aa306b47ec00b43ddae83fe2532 The package's package.json declares a postinstall lifecycle hook that pipes the output of whoami through curl to a hardcoded Burp Collaborator...
CVE-2026-52885: Time-of-check Time-of-use (TOCTOU) Race Condition
Notepad++ is a free and open-source source code editor. Prior to 8.9.6.4, NppCommands.cpp checks the HMAC of the on-disk shortcuts.xml at the moment a user command fires Time-of-Check. However, the command payload is taken from the in-memory userCommands vector, which is populated at application...
Malicious code in money-badger-open-rpc-test-bugbount (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 35c3ecacb08f3cfb0b165eadaafd3a0d6acfffc34898a6149370c8cc9ba3843e The package money-badger-open-rpc-test-bugbount was found to contain malicious code. Source: ossf-package-analysis...
CVE-2021-22352
There is a Configuration Defect Vulnerability in Huawei Smartphone. Successful exploitation of this vulnerability may allow attackers to hijack the device and forge UIs to induce users to execute malicious commands...
Google Cloud Looker 安全漏洞
Google Cloud Looker is an online tool used by Google, Inc. to transform data into customizable and informative reports and dashboards. A security vulnerability exists in Google Cloud Looker that stems from improper handling of Teradata driver parameters, which could lead to the execution of...
EUVD-2021-27190
Malware in sbrugna...
EUVD-2016-10738
Malware in sbrugna...
EUVD-2024-0674
Malicious code in bioql PyPI...
CVE-2024-45482
An Inclusion of Functionality from Untrusted Control Sphere vulnerability in the SSH server on B&R APROL 4.4-00P1 may allow an authenticated local attacker from a trusted remote server to execute malicious commands...
MAL-2025-1680 Malicious code in ownyourcode (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ae49ecc59ae81e10af1589cca5d026e0fb03269a4490c4934d61934a157d7b86 The OpenSSF Package Analysis project identified 'ownyourcode' @ 12.1.1 npm as malicious. It is considered malicious because: - The package...
MAL-2024-8932 Malicious code in @the-c-company/common-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e18cae6ce0c3de2fe7988c316471f5383433deaa0e8b9bf0376b69b634188218 The OpenSSF Package Analysis project identified '@the-c-company/common-utils' @ 1.0.0 npm as malicious. It is considered malicious because: - Th...
Malicious code in cra-docs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e49ccaa79a7296b7f1237beb3210cabf6610aab5c68e2c349b1fff4d3b2bb332 The OpenSSF Package Analysis project identified 'cra-docs' @ 7.999.45 npm as malicious. It is considered malicious because: - The package...
CVE-2023-48029: Improper Neutralization of Formula Elements in a CSV File
Corebos 8.0 and below is vulnerable to CSV Injection. An attacker with low privileges can inject a malicious command into a table. This vulnerability is exploited when an administrator visits the user management section, exports the data to a CSV file, and then opens it, leading to the execution ...
GHSA-95RP-6GQP-6622 Command Injection Vulnerability in find-exec
Older versions of the package are vulnerable to Command Injection as an attacker controlled parameter. As a result, attackers may run malicious commands. For example: const find = require"find-exec"; find"mplayer; touch hacked" This creates a file named "hacked" on the filesystem. You should neve...
Malicious Command Execution
xxl-job-core is vulnerable to malicious command execution. Lack of sanitization of new task in task management module of the background management allows an attacker to inject and execute malicious commands...
CVE-2022-28171
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious commands to the affected device...
CVE-2021-40000
The Bluetooth module has an out-of-bounds write vulnerability. Successful exploitation of this vulnerability may result in malicious command execution at the remote end...
CVE-2021-40000
CVE-2021-40000 concerns Huawei HarmonyOS Wearables. The issue is an out-of-bounds write in the Bluetooth module, with possible remote command execution at the device end. Documented sources (NVD/CNNVD/CNVD) identify the Bluetooth module as affected and describe the impact as remote code execution...
