@fanswoo/core (>=1.0.0, <=1.3.8), brws-upload (>=1.0.2, <=1.0.3) +4 more potentially affected by unknown CVE via jquery-mobile (>=1.4.1, <=1.5.0-alpha.1)

jquery-mobile NPM version =1.4.1, =1.0.0, =1.0.2, =1.0.0, =1.0.2, =2.0.0, =0.0.1, =1.0.4 Source cves: unknown CVE Source advisory: OSV:GHSA-FJ93-7WM4-8X2G...

@cpomelo/pomelo (2.2.7), @linix01/pomelo (2.2.9) +54 more potentially affected by unknown CVE via pomelo-monitor (>=0.3.5, <=0.3.7)

pomelo-monitor NPM version =0.3.5, =2.2.5, =1.0.0, =2.2.5, =0.0.1, =0.0.1, =1.0.1, =0.1.0, =2.2.6, =0.0.1, =0.1.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-M5CH-GX8G-RG73...

GHSA-4R5X-QJQC-P579 Tracking Module in botbait

The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. - Source IP - process.versions - process.platform - How the module was invoked test, requir...

Tracking Module in botbait

The module botbait is a tool to be used to track bot and automated tools usage with-in the npm ecosystem. botbait is known to record and track user information. The module tracks the following information. - Source IP - process.versions - process.platform - How the module was invoked test, requir...

@akryum/hotel (>=0.8.8, <=0.8.12), @bdefore/nivo-patterned-radial-arc (0.79.1) +19 more potentially affected by CVE-2015-9239 via ansi2html (0.0.1)

ansi2html NPM version 0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on ansi2html and may be impacted: - @akryum/hotel =0.8.8, =0.8.7, =2.0.4, =10.3.3, =1.1.0, =1.4.1, =0.9.0-0, =9.12.5, =9.12.9 and more Source cves: CVE-2015-9239 Source advisory:...

@aqsi/ui (>=3.22.0-rc.0, <=4.15.1), @ausbom/charts (>=0.1.0, <=0.1.2) +6 more potentially affected by unknown CVE via highcharts (>=8.0.0, <=8.1.0)

highcharts NPM version =8.0.0, =3.22.0-rc.0, =0.1.0, =0.0.0, =1.3.0, =7.0.0-alpha1, =16.8.1, =1.2.8, =1.0.6, =1.0.7 Source cves: unknown CVE Source advisory: OSV:GHSA-GR4J-R575-G665...

pocsuite3-1

This is a PoC Proof of Concept framework for vulnerability testing and penetration testing, developed by the Knownsec 404 Team. The framework is called pocsuite3. The framework has a powerful proof-of-concept engine and many features for penetration testers and security researchers. It supports...

nis-model (>=0.6.0, <=0.6.22), nis-view (>=0.1.1, <=0.1.8) potentially affected by CVE-2020-7703 via nis-utils (0.6.10)

nis-utils NPM version 0.6.10 is affected by a known vulnerability. The following packages have a transitive dependency on nis-utils and may be impacted: - nis-model =0.6.0, =0.1.1, =0.1.8 Source cves: CVE-2020-7703 Source advisory: SNYK:JS-NISUTILS-598799...

@blueprintjs/docs (>=1.0.0, <=1.3.1), @frctl/twig (>=1.0.0-alpha.0, <=1.0.0-beta.2) +101 more potentially affected by CVE-2020-7700 via phpjs (>=0.0.1, <=1.3.2)

phpjs NPM version =0.0.1, =1.0.0, =1.0.0-alpha.0, =0.3.16, =1.2.7, =0.1.3, =1.0.1, =1.0.0, =0.7.0, =0.0.1, =0.0.9, =0.0.1-alpha.1, =0.0.1, =0.0.7 and more Source cves: CVE-2020-7700 Source advisory: SNYK:JS-PHPJS-598681...

@decentverse/server (>=0.0.1, <=0.0.148), @swapscanner/truffle-hdwallet-provider-klaytn (1.4.2) +18 more potentially affected by CVE-2020-7717 via dot-notes (3.1.1)

dot-notes NPM version 3.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dot-notes and may be impacted: - @decentverse/server =0.0.1, =1.0.0, =1.0.0, =1.0.1-rc.4, =1.4.0-rc.1, =1.0.0, =1.6.4, =0.0.1, =1.0.0, =0.0.1, =0.1.1 and more Source cves:...

Microsoft Bug Bounty Programs Year in Review: $13.7M in Rewards

Security researchers are a vital component of the cybersecurity ecosystem that safeguards every facet of digital life and commerce. The researchers who devote time to uncovering and reporting security issues before adversaries can exploit them have earned our collective respect and gratitude. The...

Microsoft Bug Bounty Programs Year in Review: $13.7M in Rewards

Security researchers are a vital component of the cybersecurity ecosystem that safeguards every facet of digital life and commerce. The researchers who devote time to uncovering and reporting security issues before adversaries can exploit them have earned our collective respect and gratitude. The...

Microsoft Bug Bounty Programs Year in Review: $13.7M in Rewards

Security researchers are a vital component of the cybersecurity ecosystem that safeguards every facet of digital life and commerce. The researchers who devote time to uncovering and reporting security issues before adversaries can exploit them have earned our collective respect and gratitude. The...

@albalyu/npm-scripts (>=2.0.1, <=2.0.40), @opuscapita/eslint-config-opuscapita-bnapp (>=1.0.1-next.0, <=1.0.6) +7 more potentially affected by CVE-2020-36632 via flat (3.0.0)

flat NPM version 3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on flat and may be impacted: - @albalyu/npm-scripts =2.0.1, =1.0.1-next.0, =2.2.1, =2.0.0-beta.3, =0.0.1-beta.2, =4.0.1, =0.3.0-beta.16, =0.3.0-beta.83 Source cves: CVE-2020-36632 Sour...

Lazarus on the hunt for big game

We may only be six months in, but theres little doubt that 2020 will go down in history as a rather unpleasant year. In the field of cybersecurity, the collective hurt mostly crystallized around the increasing prevalence of targeted ransomware attacks. By investigating a number of these incidents...

Top MSRC 2020 Q2 Security Researchers Announced – Congratulations!

We are excited to announce the top contributing researchers for the 2020 Second Quarter Q2! Congratulations to all the researchers who continue to rock the leaderboard, and a big thank you to everyone for your contribution to securing our customers and the ecosystem. The top three researchers of...

Microsoft Intelligent Security Association expands to include managed security service providers

We’d planned a splashy party at Microsoft Inspire to announce our newest Microsoft Intelligent Security Association MISA members and introduce them to association members, but given our world today, I am instead picturing you reading this announcement curled up in a chair with a cup of coffee...

acari-lib (>=0.1.1, <=0.1.8), accepted (>=0.2.0, <=0.3.2) +1861 more potentially affected by CVE-2020-35881 via traitobject (>=0.0.1, <=0.1.1)

traitobject CARGO version =0.0.1, =0.1.1, =0.2.0, =0.0.6, =0.0.7-alpha.3, =0.0.7-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.4.2 - aigcapi 5.1.2 - aigcchain 5.1.2 - aigcconfig 5.1.2 and more Source cves: CVE-2020-35881 Source advisory: OSV:RUSTSEC-2020-0027...

Logic flaw vulnerability in Globalvillage ecosystem

Globalvillage ecosystem GVE is a virtual currency system based on blockchain technology.A security vulnerability exists in the 'approveAndCallcode' function in GVE's smart contract implementation, which stems from the program's failure to validate the callcode. The vulnerability can be exploited ...

@sap/ui5-builder-webide-extension (1.0.1), @sersap/ui5-build-tasks (>=0.0.8, <=0.0.13) +7 more potentially affected by CVE-2019-10778 via devcert-sanscache (0.4.6)

devcert-sanscache NPM version 0.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on devcert-sanscache and may be impacted: - @sap/ui5-builder-webide-extension 1.0.1 - @sersap/ui5-build-tasks =0.0.8, =1.0.0, =1.1.0, =1.0.0, =1.0.0-beta.1, =2.0.0, =1.0.0...