Malicious code in brook-galaxy-jxr850-project (npm)

The package brook-galaxy-jxr850-project was found to contain malicious code...

Malicious code in brook-peony-luh099-project (npm)

The package brook-peony-luh099-project was found to contain malicious code...

MAL-2025-16195 Malicious code in brook-rainbow-ezj133-project (npm)

The package brook-rainbow-ezj133-project was found to contain malicious code...

Malicious code in brook-whirlpool-nir965-project (npm)

The package brook-whirlpool-nir965-project was found to contain malicious code...

MAL-2025-40033 Malicious code in xylophone-brook-uti375-project (npm)

The package xylophone-brook-uti375-project was found to contain malicious code...

MAL-2025-39712 Malicious code in xerox-brook-byc200-project (npm)

The package xerox-brook-byc200-project was found to contain malicious code...

MAL-2025-16186 Malicious code in brook-aspen-jdw189-project (npm)

The package brook-aspen-jdw189-project was found to contain malicious code...

MAL-2025-23549 Malicious code in jade-brook-dtu833-project (npm)

The package jade-brook-dtu833-project was found to contain malicious code...

MAL-2025-16194 Malicious code in brook-peony-luh099-project (npm)

The package brook-peony-luh099-project was found to contain malicious code...

MAL-2025-40895 Malicious code in zephyr-brook-ftc500-project (npm)

The package zephyr-brook-ftc500-project was found to contain malicious code...

CVE-2024-51692

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in askewbrook Bing Search API Integration abbs-bing-search allows Reflected XSS.This issue affects Bing Search API Integration: from n/a through = 0.3.3...

CVE-2024-51692

CVE-2024-51692 (Bing Search API Integration, WordPress) is a reflected XSS vulnerability in the Bing Search API Integration plugin (Askew Brook) that could allow an attacker to inject and execute script during page generation. It affects the plugin version range from earlier releases up to 0.3.3....

linguistics.stonybrook.edu Cross Site Scripting vulnerability OBB-3890003

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

stonybrook.edu Cross Site Scripting vulnerability OBB-3782529

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

stonybrook.edu Cross Site Scripting vulnerability OBB-3731869

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Command Injection

github.com/txthinking/brook is vulnerable to Command Injection. The vulnerability exists due to a lack of user request validation in the local tproxy service, which allows an attacker to inject and execute arbitrary commands...

GHSA-VFRJ-FV6P-3CPF Brook's tproxy server is vulnerable to a drive-by command injection.

The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution...

CVE-2023-33965

Brook is a cross-platform programmable network tool. The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution. A patch is available in...

Command injection

Brook is a cross-platform programmable network tool. The tproxy server is vulnerable to a drive-by command injection. An attacker may fool a victim into visiting a malicious web page which will trigger requests to the local tproxy service leading to remote code execution. A patch is available in...

CVE-2023-33965

Brook's tproxy server component is vulnerable to a drive-by command injection, enabling remote code execution when a user visits a malicious page that triggers requests to the local tproxy service. A fix is available in version 20230606. The affected product is the Brook cross‑platform network to...