capnproto 环境问题漏洞

Capnproto is an open-source Proto serialization/RPC system—including core tools and C++ libraries. Versions of Capnproto prior to 1.4.0 contained environmental vulnerabilities. These vulnerabilities stemmed from the conversion of negative Content-Length values into unsigned numbers, which could...

set-in 安全漏洞

set-in is a JavaScript library developed by Mikey personally. Versions of set-in 2.0.1 to 2.0.5 had security vulnerabilities due to insufficient input validation. These vulnerabilities could allow for attacks through specially crafted input that contaminated the Object.prototype prototype, leadin...

SandboxJS 安全漏洞

SandboxJS is a security assessment tool developed by nyariv’s individual developer. Versions of SandboxJS prior to 0.8.29 contained a security vulnerability. This vulnerability stemmed from the use of hasOwnProperty to mask objects in the sandbox, allowing sandbox escape and disabling the prototy...

CVE-2020-24722

An issue was discovered in the GAEN aka Google/Apple Exposure Notifications protocol through 2020-10-05, as used in COVID-19 applications on Android and iOS. The encrypted metadata block with a TX value lacks a checksum, allowing bitflipping to amplify a contamination attack. This can cause...

carbone 安全漏洞

carbone is a report generator open-sourced by CarboneIO. A security vulnerability exists in carbone that stems from improper manipulation of the Formatter Handler component in the lib/input.js file, which could lead to a prototype contamination attack...

apidoc-core 安全漏洞

apidoc-core is an open source parser library from apiDoc. A security vulnerability exists in apidoc-core version 0.2.0 and later versions, which stems from prototype contamination and could lead to a denial of service or unexpected behavior by a remote attacker who modifies JavaScript object...

tRPC 安全漏洞

tRPC is a TypeScript framework for building type-safe APIs from the tRPC community. A security vulnerability exists in tRPC versions prior to 10.45.3 and prior to 11.8.0, which stems from a prototype contamination in the formDataToObject function that could lead to authorization bypass or denial ...

vuetify 安全漏洞

vuetify is a material component framework for Vue open-sourced by vuetify Germany. A security vulnerability exists in vuetify version 2.2.0-beta.2 through versions prior to 3.0.0-alpha.10, which stems from a prototype contamination in the Preset configuration, which could result in contaminating...

elysia 安全漏洞

elysia is a framework of elysia open source. A security vulnerability exists in elysia versions 1.4.0 through 1.4.16, which stems from a prototype contamination in the mergeDeep function that could lead to remote code execution...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

TencentOS Server 2: thunderbird (TSSA-2024:0132)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0132 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities...

Securing AI Agents against Prompt Injection Attacks

Retrieval-augmented generation RAG systems have become widely used for enhancing large language model capabilities, but they introduce significant security vulnerabilities through prompt injection attacks. We present a comprehensive benchmark for evaluating prompt injection risks in RAG-enabled A...

JavaScript Expression Evaluator 安全漏洞

JavaScript Expression Evaluator is a math calculator by Matthew Crumley Personal Developer. A security vulnerability exists in JavaScript Expression Evaluator that stems from prototype contamination and could lead to the execution of arbitrary code...

JS-YAML 安全漏洞

JS-YAML is a JavaScript YAML parser and dump from Nodeca Open Source. A security vulnerability exists in JS-YAML version 4.1.0 and earlier, which stems from the possibility of modifying prototypes when parsing YAML documents, potentially leading to prototype contamination...

Malicious code in moki-nik-hifdagujbagaifah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3fb462c66586c367e7fe5639a99621f4a69a8df103a5401bc440e572579a809d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180481 Malicious code in teate-thy-sonic-hudfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbee838f9f6629b391fc7a88745160312e5d815f1108c24747e7d6d95d1ee76c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in stellarhunter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efde1a229d98659ff10d9a0ae02fb6d05b769d1679df279190c1e2b23ebb9805 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in inufgi-gobagilai-janigaga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 861fe22493250b154930bbdb5aaf83f7f80cf1c8bd2bc077bfce3556fd5853c1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-167047 Malicious code in teagood-lokina79 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef36a7558fbe0e4bf398c0cb01ad8c4ee51a0b794d1e55f20e38172a0eb998f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-166858 Malicious code in teagood-cuekin89 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8b1f214244ff59309cc7d9b75787074f4677550e424b92785097f9813dffa8f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...