743 matches found
Malicious code in chromeos-webdriver-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1bbf3413f6465a1f8bb628dcdb79f59ac7c197bbfba2024202c9915f95ad8161 The package's postinstall script runs on npm install and issues an HTTPS POST to https://kvpq6u62.instances.poc.jchunt.top/chromeos-webdriver-cli...
Malicious code in chromecast-webdriver-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c858cd5357d77c39366f7bd1cc1985a5d7012d33da45d6dc9667544b54198d6 [email protected] runs a postinstall lifecycle script that collects host metadata os.hostname, platform, arch, node version, package nam...
PYSEC-2026-1239 changedetection.io path traversal using file URI scheme without supplying hostname
Summary The validation for the file URI scheme falls short, and results in an attacker being able to read any file on the system. This issue only affects instances with a webdriver enabled, and ALLOWFILEURI false or not defined. Details The check used for URL protocol, issafeurl, allows file: as ...
PYSEC-2026-1240 changedetection.io Path Traversal
Summary When a WebDriver is used to fetch files source:file:///etc/passwd can be used to retrieve local system files, where the more traditional file:///etc/passwd gets blocked Details The root cause is the payload source:file:///etc/passwdpasses the regex here and also passes the check here wher...
Astra Linux – Vulnerability in Firefox
The Remote Agent, used in WebDriver, did not validate the Host or Origin headers. This could have allowed websites to connect back locally to the user’s browser to control it. This bug only affected Firefox when WebDriver was enabled, which is not the default configuration.. This vulnerability...
Astra Linux – Vulnerability in Zabbix
The WebDriver for the Browser object expects an error object to be initialized when the webdriversessionquery function fails. However, this function can fail for various reasons without an error description. As a result, wd-error will be NULL, and attempting to access it will cause a crash...
EUVD-2025-177752
Malicious code in morgan-spectron-webdriver-primatology-aldebaran npm...
EUVD-2025-179312
Malicious code in despina-publish-spectron-webdriver-dotenv-safe npm...
EUVD-2025-175617
Malicious code in webdriver-manager-cosmos-mongoose-got npm...
EUVD-2025-175618
Malicious code in webdriver-manager-bulma-pino-pretty-hercules npm...
EUVD-2025-176542
Malicious code in sails-soap-link-webdriver-mocha npm...
EUVD-2025-178250
Malicious code in juno-areology-dorado-webdriver-mocha npm...
EUVD-2025-176261
Malicious code in spectron-webdriver-async-primatology-canopus npm...
EUVD-2025-175608
Malicious code in webdriver-mocha-apollo-server-shelljs npm...
EUVD-2025-177648
Malicious code in neptune-webdriver-manager-vuetify-boson npm...
EUVD-2025-178765
Malicious code in ganymede-webdriver-manager-convict-equinox npm...
EUVD-2025-176257
Malicious code in spectroscopy-webdriver-manager-await-bootstrap npm...
EUVD-2025-179712
Malicious code in cli-webdriver-manager-lint-staged-auth npm...