MAL-2025-43 Malicious code in grafana-sentry-datasource (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f64ac119461c222b3a037a8fb79c1239e05e03cbce16d87f17ce6f1bb3a857a7 Any computer that has this package install...

MAL-2025-3 Malicious code in safe-apps-react-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4844f797621f2cd62b20851643278b7d27cfc2ca46fdd1485383cd7818d5c0a8 Any computer that has this package install...

MAL-2025-2 Malicious code in payouts-banking-info (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d795b5a9cc9952f39cd020e529f31f96f837544ae12bdb31f13d66970d9824d4 Any computer that has this package install...

MAL-2024-12175 Malicious code in fider (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e33a8112ebd5139a50734b023e3b935048b314e8fd783e73722625dd79241c69 Any computer that has this package install...

MAL-2024-12169 Malicious code in faucet-microservice (npm)

This package exfils sensitive data to a attacker-controlled domain via index.js. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d09b2cef4e107bb3f98de2f43a639670bd0e2bb64a519c56e6c2c216c371659 Any computer that has this package installed or running should be...

MAL-2024-12177 Malicious code in babel-preset-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c7766597c4e69a6b6b08fb89e552f8cff845299eb1b612ef107e5f3fcb96156 Any computer that has this package install...

MAL-2024-12171 Malicious code in mx-exchange-docs (npm)

This package exfils sensitive data to a attacker-controlled domain via index.js. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86097f31b903420b95d8b161339744186e28bf4894231a435e0889e51ef07a8e Any computer that has this package installed or running should be...

MAL-2024-12172 Malicious code in officebrowserfeedback (npm)

This package exfils sensitive data to a attacker-controlled domain via index.js...

MAL-2024-12173 Malicious code in solaraexecutor (npm)

This package uses obfuscation to hide that its downloading a malicious binary from an attacker-controlled domain --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8807e1265b0c39afd3a6507559deb211f67d9a559b8094aecea14d18f30dcf7 Any computer that has this package...

MAL-2024-12174 Malicious code in xeno.dll (npm)

This package uses obfuscation to hide that its downloading a malicious binary from an attacker-controlled domain --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8903fab539c0352f278ee3116807f48f52403f7e26b855fe9d68c3328012200d Any computer that has this package...

CVE-2024-13040 Quanta Computer QOCA aim - Authorization Bypass

The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to...

CVE-2024-13040 Quanta Computer QOCA aim - Authorization Bypass

The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key vulnerability. By controlling the user ID parameter, remote attackers with regular privileges could access certain features as any user, modify any user's account information and privileges, leading to...

CVE-2024-13040

CVE-2024-13040 details (Quanta Computer QOCA aim): A vulnerability titled “Authorization Bypass Through User-Controlled Key” arises from allowing manipulation of the user ID parameter. Remote attackers with regular privileges could access features as any user, modify any user’s account informatio...

PT-2024-17898 · Quanta Computer · Qoca Aim

Name of the Vulnerable Software and Affected Versions: Quanta Computer's QOCA aim affected versions not specified Description: The QOCA aim from Quanta Computer has an Authorization Bypass Through User-Controlled Key issue. By controlling the user ID parameter, remote attackers with regular...

Authorization Bypass Through User-Controlled Key

Overview khoj is a Your Second Brain Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the updatesubscription endpoint. An authenticated attacker can modify other users' Stripe subscriptions by manipulating the email parameter in the...

Authorization Bypass Through User-Controlled Key

Overview nilsteampassnet/teampass is a password manager. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to improper handling of user session identifiers through the users.queries.php component. An attacker can escalate privileges and perfo...

MAL-2024-12161 Malicious code in crypto-buddies (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 87bd38c4e59327027fe55c21e59d50ddf6e0ecd5c9a488ed53932639fa8927fb Any computer that has this package install...

MAL-2024-12162 Malicious code in v2-foundry (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 761f1bf228ed4db14be182b91d2442d9b00aa33e118b7d0e3e341bf015eac5b9 Any computer that has this package install...

MAL-2024-12160 Malicious code in unisocks (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7048c72cc0d604b91309e2009ab3661aa15f1f3199079d12871d1a54a2041b6b Any computer that has this package install...

Malicious code in unisocks (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7048c72cc0d604b91309e2009ab3661aa15f1f3199079d12871d1a54a2041b6b Any computer that has this package install...