CVE-2023-0443

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked...

CVE-2023-1904

In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Octopus Server...

CVE-2023-27584

Dragonfly is an open source P2P-based file distribution and image acceleration system. It is hosted by the Cloud Native Computing Foundation CNCF as an Incubating Level Project. Dragonfly uses JWT to verify user. However, the secret key for JWT, "Secret Key", is hard coded, which leads to...

CVE-2023-27581

github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0 and prior to version 4.4.1, this action uses the github.headref parameter in an insecure way. This vulnerability can be triggered by any user on...

MAL-2025-4346 Malicious code in feature-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97f8b69bc45a74bab5c69310a0fa0c0cd724a8d2cb1372feef78a963a76619c5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in plugin-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6894a10f2cae1576d4b28556e817ceae00aa303e12f88eeca933fcc6c0c8f891 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4347 Malicious code in feng-npm-test666 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ad520ab3e0e84f303e6b0e5e88dfcb8337c3d79c451bbbfc805f34020e1cdba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-46943

An issue was discovered in NPM's package @evershop/evershop before version 1.0.0-rc.8. The HMAC secret used for generating tokens is hardcoded as "secret". A weak HMAC secret poses a risk because attackers can use the predictable secret to create valid JSON Web Tokens JWTs, allowing them access t...

CVE-2023-29010

Budibase is a low code platform for creating internal tools, workflows, and admin panels. Versions prior to 2.4.3 07 March 2023 are vulnerable to Server-Side Request Forgery. This can lead to an attacker gaining access to a Budibase AWS secret key. Users of Budibase cloud need to take no action...

CVE-2023-20038

A vulnerability in the monitoring application of Cisco Industrial Network Director could allow an authenticated, local attacker to access a static secret key used to store both local data and credentials for accessing remote systems. This vulnerability is due to a static key value stored in the...

MAL-2025-4344 Malicious code in fc-accordion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 210de408ab14e017cef0be232b4fa4a6e52c465f94891c6101375adccd1df98c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4312 Malicious code in client-controls-module (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05882e6ffaedb0ff1165a1ab54a27887a61d76cdaf70239fe447149da971a835 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4302 Malicious code in badoo-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f34bcbd01ca161f63d72e98370e08614774ebfcc25c4b90ac0ec79d6825baff7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in makitest_npm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c4bce38be2f9dbf07fa9b64f7ff409ebcc2cd187af5a741804b069b2387c1a69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in performance-appraisal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fdbbe3c18d12e46e21b82f0cd45dd7a710cb5d467be8dfd538483a6aa5bf3f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4304 Malicious code in bkwebportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7c39ef0c973b66c8961eb724a9f266786f1ce3683c4f2f1925ade0f5e4d39c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in event-sharing-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13f49cdbe899b99a1893c1bbba29d21d1f5b38fb841d0e2b297c9ed7c4f974b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4343 Malicious code in event-sharing-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13f49cdbe899b99a1893c1bbba29d21d1f5b38fb841d0e2b297c9ed7c4f974b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4361 Malicious code in inhouse-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e8e839e62290d15c37784e435ea01c0bde7eadec64e65d02b3dcc3eeb01acf5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wsticket (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7332aa1bc786ac92ad941e301b7f14c28be71906774177abcf327c06dd9021b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...