307 matches found
EUVD-2025-64487
Malicious code in distinctsolez3n npm...
Malicious code in distinct_penguin_requirement (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b2db2d2e698ba915cbec6c3d414e84526958eef2290e2da2ba5967992aa46596 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-86472
Malicious code in distinctdeerz3n npm...
Malicious code in distinct_baboon_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77899d0f0b0f4664fc8c8d8b2206eed5f0c5f9e70dc09c18bf3b1133b3b9266b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-67792 Malicious code in distinct-plum-hookworm (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ff8e3549fd4979bd9f4a23fee3554403982811b377bcb743d9ab47c8be88d8cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-54857
Malicious code in distinct-plum-hookworm npm...
Malicious code in distinct-purple-ladybug (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5040f0633f5b60c6cddbdebf976bcc6c8ad99f12554b255398caf6625b5d0d69 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-54856
Malicious code in distinct-purple-ladybug npm...
EUVD-2025-54858
Malicious code in distinct-moccasin-woodpecker npm...
EUVD-2025-60063
Malicious code in distinctcrabz3n npm...
MAL-2025-55904 Malicious code in distinct_porpoise_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c9fb353218981aa03999ee0625c6969a582f803c76f4ac834d58a80cacee39d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-11750
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...
CVE-2025-11750 User Enumeration via Distinct Error Messages in langgenius/dify-web
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...
CVE-2025-11750 User Enumeration via Distinct Error Messages in langgenius/dify-web
In langgenius/dify-web version 1.6.0, the authentication mechanism reveals the existence of user accounts by returning different error messages for non-existent and existing accounts. Specifically, when a login or registration attempt is made with a non-existent username or email, the system...
dify 安全漏洞
dify is an open source LLM application development platform from LangGenius Open Source. A security vulnerability exists in version 1.6.0 of dify, which stems from the authentication mechanism returning different error messages for non-existing and existing accounts, potentially leading to an...
PT-2025-43031
Name of the Vulnerable Software and Affected Versions langgenius/dify-web version 1.6.0 Description The authentication process in the software reveals whether user accounts exist by providing different error messages depending on whether a username or email is registered. Attempting to log in or...
EUVD-2025-34455
Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages...
EUVD-2019-8870
Malware in sbrugna...
CVE-2025-58586
CVE-2025-58586 affects SICK Enterprise Analytics and SICK Logistic Analytics products. The vulnerability stems from distinct error messages for login failures (incorrect password vs. non-existent username), enabling attacker-driven username enumeration. Reported impact: information disclosure (us...