Malicious code in eth-based-p2p-e2e-latency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 596b12335f8cd6e12055b2a8df2f4afb1a74c9275d3f22a0e21bc003956092ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10740 Malicious code in spirvls (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bba9fe6fc980865e5643c34c0726f1a0f4fddf0e445aa865036b6024d56026b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in arkoselabs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16b2091fae4c54db03b3115cf52717160432074803439f716332ff9c35482ba7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in autolink-jira-issue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d899824dec6a9efaddf4482f495ca1b557fc0ec18d4371e0214c6397fd95ee71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-51757 Fixes security vulnerability that allowed for server side code to be executed by a <script> tag

happy-dom is a JavaScript implementation of a web browser without its graphical user interface. Versions of happy-dom prior to 15.10.2 may execute code on the host via a script tag. This would execute code in the user context of happy-dom. Users are advised to upgrade to version 15.10.2. There ar...

CVE-2024-48059

gaizhenbiao/chuanhuchatgpt project, version =20240802 is vulnerable to stored Cross-Site Scripting XSS in WebSocket session transmission. An attacker can inject malicious content into a WebSocket message. When a victim accesses this session, the malicious JavaScript is executed in the victim's...

CVE-2024-50307

Use of potentially dangerous function issue exists in Chatwork Desktop Application Windows versions prior to 2.9.2. If a user clicks a specially crafted link in the application, an arbitrary file may be downloaded from an external website and executed. As a result, arbitrary code may be executed ...

CVE-2024-47158

N-LINE 2.0.6 and prior versions contain a code injection vulnerability. If this vulnerability is exploited, arbitrary code may be executed on the instructor's browser, or the instructor may be directed to a malicious website...

CVE-2024-47158

N-LINE 2.0.6 and prior versions contain a code injection vulnerability. If this vulnerability is exploited, arbitrary code may be executed on the instructor's browser, or the instructor may be directed to a malicious website...

Malicious code in atg-superagent-retry-delay (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 75f0747e74a5e0a7d519918b8aceef9e8f4f9eaa0ad1854c1954276bb1c5166c The OpenSSF Package Analysis project identified 'atg-superagent-retry-delay' @ 100.100.100 npm as malicious. It is considered malicious because:...

CVE-2024-48937

Znuny before LTS 6.5.1 through 6.5.10 and 7.0.1 through 7.0.16 allows XSS. JavaScript code in the short description of the SLA field in Activity Dialogues is executed...

CVE-2024-48937

Znuny has a cross-site scripting vulnerability (CVE-2024-48937) affecting Znuny before LTS 6.5.1–6.5.10 and 7.0.1–7.0.16, where JavaScript executed from the short description of the SLA field in Activity Dialogues can be triggered. The underlying issue is an XSS in the SLA short description conte...

GHSA-255W-87RH-RG44 Cross-site Scripting via uploaded SVG

In Sulu v2.0.0 through v2.6.4 are vulnerable against XSS whereas a low privileged user with an access to the “Media” section can upload an SVG file with a malicious payload. Once uploaded and accessed, the malicious javascript will be executed on the victims’ other users including admins browsers...

Malicious code in @the-c-company/common-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e18cae6ce0c3de2fe7988c316471f5383433deaa0e8b9bf0376b69b634188218 The OpenSSF Package Analysis project identified '@the-c-company/common-utils' @ 1.0.0 npm as malicious. It is considered malicious because: - Th...

Calibre Python Code Injection (CVE-2024-6782)

This module exploits a Python code injection vulnerability in the Content Server component of Calibre v6.9.0 - v7.15.0. Once enabled disabled by default, it will listen in its default configuration on all network interfaces on TCP port 8080 for incoming traffic, and does not require any...

Malicious code in lit-3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58fa9943fe7f3a2ad80c2d7ec817ab05718838e0aef345b7d44416f0f525cdc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in broadcast-podlet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 73de5f4ddc33163129934b982d533ce73fdfe00485428f486f3b8d2312de1537 The OpenSSF Package Analysis project identified 'broadcast-podlet' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2024-39457

Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser...

CVE-2024-39457

Cybozu Garoon 6.0.0 to 6.0.1 contains a cross-site scripting vulnerability in PDF preview. If this vulnerability is exploited, an arbitrary script may be executed on a logged-in user’s web browser...

Malicious code in marvinjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 965b7b4455eec757889260ad7d11671ee747f1d78f5ccca323303d223f246c43 The OpenSSF Package Analysis project identified 'marvinjs' @ 5.5.6 npm as malicious. It is considered malicious because: - The package...