Visual Studio Code Server Files Detected

Visual Studio Code is a popular source-code editor provided by Microsoft, with extensions offering a variety of extra functionality including remote workspace access via ssh. Use of this remote workflow creates a hidden directory named .vscode-server on the remote server which may be exposed with...

Integer Overflow in Endian Library

Lines of code Vulnerability details Impact An integer overflow can lead to unexpected behavior in a smart contract, potentially causing financial loss or disruption of the contract's intended functionality. Proof of Concept If the input value passed to the function exceeds 64 bits, an integer...

Malicious Package

Overview vscode-github-actions is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious code in vscode-github-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9186f60970b4228055c97ae3bbbf2c4691411f82c44db8033fc56d68cae50fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-945 Malicious code in vscode-github-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9186f60970b4228055c97ae3bbbf2c4691411f82c44db8033fc56d68cae50fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-946 Malicious code in vscode-smoketest-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 137816df474676baa29f1ab9e87b99bfda74ca256ea10e09f9a7971bc580302f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-smoketest-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 137816df474676baa29f1ab9e87b99bfda74ca256ea10e09f9a7971bc580302f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-45025

Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function...

Command injection

Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function...

Design/Logic Flaw

An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process...

CVE-2022-45025

Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function...

CVE-2022-45025

Markdown Preview Enhanced for VSCode and Atom (versions 0.6.5–0.19.6) contains a command-injection vulnerability via the PDF file import function. The Red Hat/GH reports describe an OS command injection via spawn with shell: true in the Mume library (pdf.ts), enabling arbitrary code execution if ...

CVE-2022-45026

Markdown Preview Enhanced for VSCode and Atom (versions 0.6.5–0.19.6) contains a command-injection flaw during the GFM export process. The root cause is an issue in how the extension handles GFM export, allowing arbitrary commands to be executed by an attacker. A PoC exploit is indicated in the c...

CVE-2022-45026

An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process...

CVE-2022-45025

Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function...

CVE-2022-45026

An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process...

CVE-2022-45026

An issue in Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom allows attackers to execute arbitrary commands during the GFM export process...

MAL-2022-4586 Malicious code in microsoft-data-mapper-vscode-extension (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 678ab57585e9c697e1a9baf24e9622476369f342f5ac0dbd5ec273045472a213 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VSCode ipynb Remote Development RCE

VSCode when opening an Jupyter notebook .ipynb file bypasses the trust model. On versions v1.4.0 - v1.71.1, its possible for the Jupyter notebook to embed HTML and javascript, which can then open new terminal windows within VSCode. Each of these new windows can then execute arbitrary code at...

CVE-2022-31691

Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor and Cloudfoundry Manifest YML Support version 1.39.0 and below all use Snakeyaml library for YAML editing support. This library allows for some...