313 matches found
CVE-2026-32101 StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...
CVE-2026-32101
CVE-2026-32101 affects StudioCMS S3 Storage Manager prior to version 0.3.1. The isAuthorized() function is async but is called without await in both the POST and PUT handlers, causing the authorization check to always evaluate to bypass due to Promise objects being truthy. As a result, any authen...
CVE-2026-32101 StudioCMS S3 Storage Manager Authorization Bypass via Missing `await` on Async Auth Check
StudioCMS is a server-side-rendered, Astro native, headless content management system. Prior to 0.3.1, the S3 storage manager's isAuthorized function is declared async returns Promise but is called without await in both the POST and PUT handlers. Since a Promise object is always truthy in...
MAL-2026-1320 Malicious code in chain-promised-await (npm)
Remote code execution via fetching code from a remote URL and Discord webhook usage indicates malicious intent. Single version adds to suspicion. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b882a33fdd394ef7a848100d8ee39ef4c7f0747942b4bea86e38af5780c978 The...
Malicious code in chain-promised-await (npm)
Remote code execution via fetching code from a remote URL and Discord webhook usage indicates malicious intent. Single version adds to suspicion. --- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5b882a33fdd394ef7a848100d8ee39ef4c7f0747942b4bea86e38af5780c978 The...
MAL-2026-852 Malicious code in chai-await (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 463f0440f6a90a98f9a12131b19f99b472b0ee82b6feb5b6066996ca4be4e07a The package chai-await was found to contain malicious code. Source: ghsa-malware c3cd8be2d97babb314b0adf3d3b9b6467057d39f64e41afe5d5f33cad5e3fbe6 Any...
Malicious Package
Overview chai-await is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious code in chai-await (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 463f0440f6a90a98f9a12131b19f99b472b0ee82b6feb5b6066996ca4be4e07a The package chai-await was found to contain malicious code. Source: ghsa-malware c3cd8be2d97babb314b0adf3d3b9b6467057d39f64e41afe5d5f33cad5e3fbe6 Any...
MiracleLinux 9 : firefox-91.9.1-1.el9.ML.1 (AXSA:2022-4012:30)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4012:30 advisory. Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution CVE-2022-1529 Mozilla: Prototype pollution in Top-Level...
MiracleLinux 9 : thunderbird-91.9.1-1.el9.ML.1 (AXSA:2022-4007:17)
The remote MiracleLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-4007:17 advisory. Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution CVE-2022-1529 Mozilla: Prototype pollution in Top-Level...
MiracleLinux 8 : firefox-91.9.1-1.el8.ML.1 (AXSA:2022-3199:13)
The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3199:13 advisory. Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution CVE-2022-1529 Mozilla: Prototype pollution in Top-Level...
MiracleLinux 8 : thunderbird-91.9.1-1.el8.ML.1 (AXSA:2022-3201:07)
The remote MiracleLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2022-3201:07 advisory. Mozilla: Untrusted input used in JavaScript object indexing, leading to prototype pollution CVE-2022-1529 Mozilla: Prototype pollution in Top-Level...
Malicious code in chai-tests-await (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e06b5ce760a0d0c13a10c5738f8e32b1b4a973261792b91f120017fa30e8352 The package chai-tests-await was found to contain malicious code. Source: ghsa-malware f36b7f537c61a8edb98af7f5d3c8fbc98d47dc0566ead08de39bab2fa58104...
EUVD-2025-204882
Malicious code in chai-tests-await npm...
MAL-2025-192742 Malicious code in chai-tests-await (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e06b5ce760a0d0c13a10c5738f8e32b1b4a973261792b91f120017fa30e8352 The package chai-tests-await was found to contain malicious code. Source: ghsa-malware f36b7f537c61a8edb98af7f5d3c8fbc98d47dc0566ead08de39bab2fa58104...
EUVD-2025-201136
Malicious code in chai-test-await npm...
Malicious code in chai-test-await (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc4f5ebd52a0912210e31f29b89e1199fadcf3bfddd5557b38e388f9b6df8315 The package chai-test-await was found to contain malicious code. Source: ghsa-malware a25b0475f84c41d68c89ffad60b4dc123876d634fbe93a793fae42da8e1112b...
MAL-2025-192289 Malicious code in chai-test-await (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cc4f5ebd52a0912210e31f29b89e1199fadcf3bfddd5557b38e388f9b6df8315 The package chai-test-await was found to contain malicious code. Source: ghsa-malware a25b0475f84c41d68c89ffad60b4dc123876d634fbe93a793fae42da8e1112b...