PT-2022-24866 · Pypi · Dparse

Name of the Vulnerable Software and Affected Versions: dparse versions prior to 0.5.2 Description: dparse is a parser for Python dependency files. The issue concerns a regular expression that is vulnerable to a Regular Expression Denial of Service ReDoS. All users parsing index server URLs with...

Malicious Package

Overview @dtci/eq-ui-lib is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious Package

Overview bjabaiheiiyuuui is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious Package

Overview migrate-ux-react is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious Package

Overview sb1-atbyls-idanecoa is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packa...

Malicious Package

Overview democritus-dates is a malicious package. This package is used for dependency confusion attempts and contains malicious code. The package now exists as a placeholder on PyPI. Remediation Avoid using all malicious instances of the democritus-dates package. References - GitHub Issue - GitHu...

Malicious Package

Overview democritus-domains is a malicious package. This package is used for dependency confusion attempts and contains malicious code. The package now exists as a placeholder on PyPI. Remediation Avoid using all malicious instances of the democritus-domains package. References - GitHub Issue -...

Malicious Package

Overview democritus-json is a malicious package. This package is used for dependency confusion attempts and contains malicious code. The package now exists as a placeholder on PyPI. Remediation Avoid using all malicious instances of the democritus-json package. References - GitHub Issue - GitHub...

Malicious Package

Overview democritus-hypothesis is a malicious package. This package is used for dependency confusion attempts and contains malicious code. The package now exists as a placeholder on PyPI. Remediation Avoid using all malicious instances of the democritus-hypothesis package. References - GitHub Iss...

Malicious Package

Overview duckduckgo-privacy-extension is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

PT-2022-24368 · Tenda · Tenda Ac18 Wifi Router +1

Name of the Vulnerable Software and Affected Versions: Tenda AC15 WiFi Router version V15.03.05.19 multi Tenda AC18 WiFi Router version V15.03.05.19 multi Description: A buffer overflow issue was discovered via the filePath parameter at the "/goform/expandDlnaFile" API endpoint. Recommendations:...

PT-2022-4937 · Isc +12 · Bind +12

Name of the Vulnerable Software and Affected Versions: BIND versions prior to the fixed version Description: The issue is related to a flaw in the DNSSEC implementation of the BIND DNS server, specifically with the incorrect verification of the EdDSA cryptographic signature. This can be exploited...

Malicious Package

Overview ts-petstore-client is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview com.unity.film-internal-utilities is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable...

Malicious Package

Overview @iamexperiences/react-auth is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...

PT-2022-5109 · Adobe · Incopy

Name of the Vulnerable Software and Affected Versions: Adobe InCopy versions 17.3 and earlier Adobe InCopy versions 16.4.2 and earlier Description: The issue is related to a Heap-based Buffer Overflow that could result in arbitrary code execution in the context of the current user. Exploitation...

PT-2022-5062 · Adobe · Bridge

Name of the Vulnerable Software and Affected Versions: Adobe Bridge versions 12.0.2 and earlier Adobe Bridge versions 11.1.3 and earlier Description: The issue is related to an out-of-bounds read in memory when parsing a crafted file, which could result in reading past the end of an allocated...

PT-2022-5233 · Adobe · Photoshop

Name of the Vulnerable Software and Affected Versions: Adobe Photoshop versions 22.5.8 and earlier Adobe Photoshop versions 23.4.2 and earlier Description: The issue is related to a Use After Free vulnerability that could result in arbitrary code execution in the context of the current user...

PT-2022-5048 · Adobe · Indesign

Name of the Vulnerable Software and Affected Versions: Adobe InDesign versions 16.4.2 and earlier Adobe InDesign versions 17.3 and earlier Description: The issue is related to an out-of-bounds read that could lead to disclosure of sensitive memory. An attacker could leverage this to bypass...

PT-2022-5081 · Adobe · Bridge

Name of the Vulnerable Software and Affected Versions: Adobe Bridge versions 12.0.2 and earlier Adobe Bridge versions 11.1.3 and earlier Description: The issue is related to an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. This...