CLSA-2026-1782176268 TuxCare security update for bower (2 CVEs)

TuxCare rebuilt bower to address 2 CVEs. Fixed in 1.8.4-tuxcare.1...

Malicious code in google-caja-bower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e34339f1be6afb8a41b6dbe2f7d7c480d5a438a67ff119b235d1d98ffa2b2e4a [email protected] declares scripts.preinstall = 'node index.js', so index.js runs automatically on npm install. index.js walks the...

MAL-2026-10186 Malicious code in google-caja-bower (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e34339f1be6afb8a41b6dbe2f7d7c480d5a438a67ff119b235d1d98ffa2b2e4a [email protected] declares scripts.preinstall = 'node index.js', so index.js runs automatically on npm install. index.js walks the...

EUVD-2019-0674

Malware in sbrugna...

moment-timezone

This repository is an add-on for Moment.js, a JavaScript library for working with dates and times. It provides support for timezones, allowing users to easily work with dates and times in different timezones. The repository contains a variety of files, including a Gruntfile.js, which is used to...

Malicious code in drupal-bower-install (npm)

The package drupal-bower-install was found to contain malicious code...

MAL-2025-18840 Malicious code in drupal-bower-install (npm)

The package drupal-bower-install was found to contain malicious code...

CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

Cross-site Scripting (XSS)

Overview org.webjars.bower:trix is a Rich Text Editor. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the copy and paste functionality. An attacker can execute arbitrary JavaScript code within the user's session by tricking a user into pasting malicious...

Malicious code in grunt-bowerspawn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f19c7ffe5b8c7e758f111d8a269b08c66ef7dd51229dae215a6b7ecd967b3db Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@garment/plugin-runner-publish (>=0.13.7, <=0.18.0), bower-npm-resolver (0.11.0) +4 more potentially affected by CVE-2022-0355 via simple-get (3.0.3)

simple-get NPM version 3.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on simple-get and may be impacted: - @garment/plugin-runner-publish =0.13.7, =3.2.4, =2.0.3, =2.0.5 Source cves: CVE-2022-0355 Source advisory: OSV:GHSA-WPG7-2C88-R8XV...

@absolunet/nwayo-cli (>=1.0.0, <=3.6.1), @absolunet/nwayo-workflow (>=3.3.0, <=3.6.1) +479 more potentially affected by CVE-2019-5484 via bower (>=1.1.2, <=1.8.4)

bower NPM version =1.1.2, =1.0.0, =3.3.0, =0.1.16-master.20181116180810, =0.1.2, =1.2.6, =1.0.1, =1.0.0, =0.2.44, =1.0.0, =1.1.1, =1.2.1 - @pattern-lab/uikit-workshop 1.0.0-alpha.7 - @pgswe/ics.js 0.1.3 - @pvsundarram/grunt-bower-task 0.4.2 - @rbrlortie/nwayo-cli 1.4.0 - @rbrlortie/nwayo-workflow...

Symlink Arbitrary File Overwrite in bower

Versions of bower prior to 1.8.8 are affected by an arbitrary file write vulnerability. The vulnerability occurs because bower does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory. Recommendation Update to version 1.8.8 or later...

CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

Path traversal

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

CVE-2019-5484

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted...

CVE-2019-5484

CVE-2019-5484 – Bower path traversal . Affects Bower up to version 1.8.7; older releases permit writing files to arbitrary locations during extraction of a malicious package via the install command. Root cause is improper validation of extracted paths, enabling directory traversal and arbitrary f...

PT-2019-17702 · Twitter · Bower

Name of the Vulnerable Software and Affected Versions: bower versions prior to 1.8.8 Description: The issue allows for a path traversal vulnerability, enabling file write in arbitrary locations via the install command. This occurs because bower does not verify that extracted symbolic links do not...