Malware in msl-example-client

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in example-marko-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 553d816403e5dd786bafbe39f79c521cc2e5bd1917b425aefd7d5f34c96400b6 The OpenSSF Package Analysis project identified 'example-marko-webpack' @ 100.0.2 npm as malicious. It is considered malicious because: - The...

MAL-2025-3950 Malicious code in example-marko-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 553d816403e5dd786bafbe39f79c521cc2e5bd1917b425aefd7d5f34c96400b6 The OpenSSF Package Analysis project identified 'example-marko-webpack' @ 100.0.2 npm as malicious. It is considered malicious because: - The...

betfairlightweight (>=0.0.0b4, <=1.8.2), example-pkg-naturalett (>=12.5.0, <=13.4.0) +8 more potentially affected by CVE-2025-47273 via setuptools (39.2.0)

setuptools PYPI version 39.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - betfairlightweight =0.0.0b4, =12.5.0, =0.6.1, =0.2.0, =0.80.8, =0.1.0, =1.0.4, =1.2.3 Source cves: CVE-2025-47273 Source advisory:...

net.sourceforge.jfacets:jfacets-acegi (>=3.1, <=3.2.1), org.acegisecurity:acegi-security (1.0.3) +28 more potentially affected by CVE-2025-22233 via org.springframework:spring-context (1.2.8)

org.springframework:spring-context MAVEN version 1.2.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-context and may be impacted: - net.sourceforge.jfacets:jfacets-acegi =3.1, =1.0.2, =1.0.2, =1.0.0, =1.0.2 -...

GHSA-QHR6-MGQR-MCHM Vyper's `concat()` builtin may elide side-effects for zero-length arguments

Impact concat may skip evaluation of side effects when the length of an argument is zero. this is due to a fastpath in the implementation which skips evaluation of argument expressions when their length is zero:...

Cross-site Scripting (XSS)

Overview label-studio is a Label Studio annotation tool Affected versions of this package are vulnerable to Cross-site Scripting XSS via the labelconfig parameter in labelstudio/projects/views.py. An attacker can execute arbitrary scripts in the context of the user's browser by sending malicious...

Malicious code in guardian-advanced-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13770fcd17968777cc4e0cab25b94ac990143f0e65b24dd910678e9b3f677539 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in guardian-advanced-example

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

PYSEC-2025-124

Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attack...

PYSEC-2025-124

Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attack...

CVE-2025-47783

Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attack...

org.apache.iotdb:customize-mqtt-example (>=1.0.0, <=1.3.3), org.apache.iotdb:influxdb-protocol (>=1.0.0, <=1.1.2) +12 more potentially affected by CVE-2024-24780 via org.apache.iotdb:iotdb-server (>=1.0.0, <=1.3.3)

org.apache.iotdb:iotdb-server MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.3.3 Source cves: CVE-2024-24780 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-10176115...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the confKey parameter. An attacker can execute arbitrary scripts in the context of the victim's browser session by injecting a malicious payload into this parameter. Note: This is only exploitable if the...

CVE-2025-47783: Improper Neutralization of Input During Web Page Generation

Label Studio is a multi-type data labeling and annotation tool. A vulnerability in versions prior to 1.18.0 allows an attacker to inject a malicious script into the context of a web page, which can lead to data theft, session hijacking, unauthorized actions on behalf of the user, and other attack...

Label Studio cross-site scripting vulnerabilities

Label Studio is an open source data labeling tool from Heartex Open Source. It allows you to label data types such as audio, text, images, video, and time series using a straightforward UI and export to a variety of model formats. A cross-site scripting vulnerability exists in Label Studio versio...

CVE-2025-46833 Programs/P73_SimplePythonEncryption.py has weak cryptographic key

Programs/P73SimplePythonEncryption.py illustrates a simple Python encryption example using the RSA Algorithm. In versions prior to commit 6ce60b1, an attacker may be able to decrypt the data using brute force attacks and because of this the whole application can be impacted. This issue has been...

Exploit for Out-of-bounds Write in Openprinting Cups

CUPS-Exploit Heap-based buffer overflow example based on C...

MAL-2025-3678 Malicious code in ascpc-npm-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7dfc46bf902782d78e5120173d965b16776b6f7d52ac27e8b6a05eb734290dce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in ascpc-npm-example

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...