Malicious code in document-inference (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0519099776ddb5cbd1778fa5f043a1cad34d94d5116ae895120aba38608e7eb0 Packages that seem to be created by a legit bug bounty hunter. Designed to look like created by different organisations, they contain a couple of data...

The vulnerability of PARTS SOFT’s CMS, related to insufficient verification of the authenticity of executed requests, allows a hacker to perform a CSRF attack.

The vulnerability of PARTS SOFT’s CMS is related to insufficient verification of the authenticity of executed requests. Exploiting this vulnerability allows a malicious actor to perform a CSRF attack by sending a specially crafted POST request...

CVE-2025-44866

Tenda W20E V15.11.0.6 was found to contain a command injection vulnerability in the formSetDebugCfg function via the level parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request...

MAL-2025-2585 Malicious code in vulnerable-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39aee709a198819a063291a6ebb8c985b0335af324647cdc6492671701bfb294 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in n11-chatbot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a368f528c1eb4b3da0f52628aed3b3e5ca54083842086c30a70a91d1110a3cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ESRI ArcGIS AllSource Untrusted Search Path Vulnerability

ESRI ArcGIS AllSource is a Intelligence Analyzer software developed by ESRI. An untrustworthy search path vulnerability exists in ESRI ArcGIS AllSource, which can be exploited by an attacker to execute malicious commands...

Malicious code in wdpr-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aa07fe623ed4f4dd2faf6053e7bdf936f13e8e3ee0dd7ffcc9af37cc778eef8c The OpenSSF Package Analysis project identified 'wdpr-test-package' @ 999.999.999 npm as malicious. It is considered malicious because: - The...

Malicious code in cros_infotest_1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d49ce8fd236e1053b560be3f562809f285f0a971956a6466386bb6be5df13de7 The OpenSSF Package Analysis project identified 'crosinfotest1' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in com.unity.2d.common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75a37bfaf17aed750692186fe017783457f38ab50f15f7a49ddb94033cb27443 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @awan_7715/model-viewer-space-opera (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e555e285993ff5179f3dad8424c83097053d02d6b4a91a72319eaabb6f1e6282 The OpenSSF Package Analysis project identified '@awan7715/model-viewer-space-opera' @ 1.1.1 npm as malicious. It is considered malicious becaus...

Tuned: `script_pre` and `script_post` options allow to pass arbitrary scripts executed by root

...

Malicious code in microsoft.applicationinsights.persistencechannel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c6d541610ea02e1c898560a24798cf5ccb4c38d66f367bc6f205cc4fe5377dc The OpenSSF Package Analysis project identified 'microsoft.applicationinsights.persistencechannel' @ 99.99.99 npm as malicious. It is considered...

Malicious code in snap-kit-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 591274c196648c43d806cc38ac33a04319ff82c5c4c9b1028590552c1fe4a841 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-28141

CVE-2024-28141 describes a Cross-Site Request Forgery vulnerability in a web application used by Image Access Scan2Net. The issue allows an attacker to trick authenticated users into performing actions on the application (e.g., resetting an admin password or creating new users) when visiting a ma...

Malicious code in @aoflmkt/app-call (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ceabbeb0d20f6267c8883498e7c31aa52148eff458969a12d2397d930978d85 The OpenSSF Package Analysis project identified '@aoflmkt/app-call' @ 100.100.106 npm as malicious. It is considered malicious because: - The...

MAL-2024-11234 Malicious code in adminconsole (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 88480db379ccb5378aada30388162f00d8033acb86b62e8d2e490533646c4a4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

LibreNMS stored cross-site scripting (XSS) vulnerability in the Device Settings section

A stored cross-site scripting XSS vulnerability in the Device Settings section of LibreNMS v24.9.0 to v24.10.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Display Name parameter...

Malicious code in finn-pulse-init (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8556cda5df574e7c339a9e910f83692fefe384dd8c3c1107fafd270c8057a170 The OpenSSF Package Analysis project identified 'finn-pulse-init' @ 1.0.7 npm as malicious. It is considered malicious because: - The package...

postgresql: PostgreSQL row security below e.g. subqueries disregards user ID changes

A flaw was found in PostgreSQL. This vulnerability allows incorrect row-level security policies to be applied via subqueries, WITH queries, security invoker views, or SQL-language functions that reference tables with row-level security policies. This issue arises when a query is planned under one...

CVE-2024-38658

CVE-2024-38658 describes an out-of-bounds read in Fuji Electric V-Server and V-Server Lite (versions 4.0.19.0 and earlier). Opening a specially crafted file may disclose information and/or allow arbitrary code execution. Affected components include the remote monitoring software and its graphic e...