Malicious code in dependency123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 327dcfe6d0167239e0fe708c0d5472bb7d8b5b6b2e6aff2e3fdb2834a88ab597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2431 Malicious code in dependency-confusion-art-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62115c516ed6fab4f4ef04cf479f484c3cf125380339eee26945b9f78ed64cb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dependency-confusion-art-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 62115c516ed6fab4f4ef04cf479f484c3cf125380339eee26945b9f78ed64cb4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2432 Malicious code in dependency-confusion-art-test2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e97039a56b87ce44acffa793c9c167d6d22b7044f784c8c3a6f2d634586eb8f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dependency-confusion-art-test2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e97039a56b87ce44acffa793c9c167d6d22b7044f784c8c3a6f2d634586eb8f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in git-dependency-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c9b4a87b0253efbaf0122b94b2b942adc6b9163f8161863bb0d334859bb9f87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3367 Malicious code in git-dependency-maker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c9b4a87b0253efbaf0122b94b2b942adc6b9163f8161863bb0d334859bb9f87 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Update initializer modifier to prevent reentrancy during initialization

Lines of code Vulnerability details Impact The solution uses: "OpenZeppelin/[email protected]". This dependency has a known high severity vulnerability: Which makes MyStrategy contract vulnerable contract MyStrategy is BaseStrategy, ReentrancyGuardUpgradeable ... function...

QueryInterface should call AddRef before returning pointer

Affected version of this crate, which is a required dependency in com-impl, provides a faulty implementation of the IUnknown::QueryInterface method. QueryInterface implementation must call IUnknown::AddRef before returning the pointer, as describe in this documentation: As it is not incrementing...

@manniwatch/client-desktop (>=0.28.0, <=0.28.2), @yeti-dev/electroshot (>=1.4.3, <=1.4.6) +5 more potentially affected by CVE-2022-29247 via electron (>=15.0.0, <=15.3.7)

electron NPM version =15.0.0, =0.28.0, =1.4.3, =1.0.0, =2.0.53, =6.0.15, =6.1.2 - simple-git-gui 3.8.2 - xyz-ttooc-log-electron-windows 0.1.5 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...

@finsemble/finsemble-electron-adapter (>=7.0.0-beta.2, <=7.0.1), @manniwatch/client-desktop (>=0.28.3, <=0.29.1) +9 more potentially affected by CVE-2022-29247 via electron (>=16.0.2, <=16.2.3)

electron NPM version =16.0.2, =7.0.0-beta.2, =0.28.3, =0.0.1, =0.0.14, =0.0.15, =2.0.56, =1.0.1, =1.0.0, =1.0.0, =0.0.1, =0.0.3 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...

@ascua/electron (0.0.227), @finsemble/finsemble-electron-adapter (>=1.0.0-beta-1, <=7.3.11) +5 more potentially affected by CVE-2022-29247 via electron (>=17.0.0, <=17.1.2)

electron NPM version =17.0.0, =1.0.0-beta-1, =0.29.10, =0.18.16, =2.0.69, =3.14.5, =6.2.5 Source cves: CVE-2022-29247 Source advisory: OSV:GHSA-MQ8J-3H7H-P8G7...

Update initializer modifier to prevent reentrancy during initialization

Lines of code Vulnerability details Proof of Concept The code uses: @openzeppelin-contracts-upgradeable=OpenZeppelin/[email protected]/contracts/ This dependency have a known high severity vulnerability: Which makes the main contract in this audit "MyStrategy" vulnerable...

Update initializer modifier to prevent reentrancy during initialization

Lines of code Vulnerability details The solution uses: OpenZeppelin/[email protected] These dependencies have a known high severity vulnerability: Which makes these contracts vulnerable: Recommended Mitigation Steps Upgrade @openzeppelin/contracts-upgradeable to version 4.4...

PT-2022-3393 · Pypi · Request +1

Name of the Vulnerable Software and Affected Versions: keep versions prior to 1.2 Description: The issue is related to a code-execution backdoor inserted by a third party in the keep package for Python. This backdoor is associated with a malicious dependency named request. Exploitation of this...

CVE-2022-31023

Play Framework is a web framework for Java and Scala. Verions prior to 2.8.16 are vulnerable to generation of error messages containing sensitive information. Play Framework, when run in dev mode, shows verbose errors for easy debugging, including an exception stack trace. Play does this by...

CVE-2021-34078

lifion-verify-dependencies through 1.1.0 is vulnerable to OS command injection via a crafted dependency name on the scanned project's package.json file...

MAL-2022-1362 Malicious code in azure-pipelines-dependency-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8de0a03478a809b8f29b605fa046f7b89e682904f1dbfb3321aa9e64df94f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in azure-pipelines-dependency-track (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d8de0a03478a809b8f29b605fa046f7b89e682904f1dbfb3321aa9e64df94f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dependencyconfusioncve2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99a26d12e87e1df9f320758a4d87d8db3276c26017deb168e0a860275fd85d1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...