Malicious code in tasks_mangement (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5af70a269afd5435306a85b902070f929d511d8855e369cc7c930a9dc50be50 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

External Control of Assumed-Immutable Web Parameter

Overview sylius/paypal-plugin is a PayPal plugin for Sylius. Affected versions of this package are vulnerable to External Control of Assumed-Immutable Web Parameter. The user-input payment amount is not adequately confirmed to be the same between initial entry and payment completion, in...

CVE-2023-45588

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2023-45588

An external control of file name or path vulnerability CWE-73 in FortiClientMac version 7.2.3 and below, version 7.0.10 and below installer may allow a local attacker to execute arbitrary code or commands via writing a malicious configuration file in /tmp before starting the installation process...

CVE-2025-24996

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

Malicious code in smart-power-strip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1cc33c4b430e08bef89e4f67199d79002235613631ee986f8566d757fc14ea7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2379 Malicious code in elementor-editor-github-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72f60b6d3f909084d15e59acc80082db35f713c520dc29ff74ec2a79ceb33dcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dvd-ai-pc-rag (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a767db3d0d8194ea0442ea2138060477dfc8356ba986a5e7a707145af45d9427 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in events-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab45d10dfa09f0ea69e25ef62c978634d9b929402d3875a2687180c005723eca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm-testlist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 719312e2aaf577f4308c89250b75cd26b241aa1e8e15fa6f3eb9392d5a7a67d4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chialisp-lsp-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aeede289ccdfe7d4487e01b4eb54ed16a8666295df50031d9369d92f75d0d51e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-24996

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network...

CVE-2025-24054

CVE-2025-24054 is a Windows NTLM vulnerability allowing an attacker to induce NTLMv2-SSP hash disclosure by leveraging explorer.exe to fetch remote SMB resources via crafted file types (notably .library-ms and .lnk/.library-ms payloads). Public PoCs and exploits demonstrate creating malicious .li...

MAL-2025-2181 Malicious code in makerspace-cpx-intro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f001e9f23b801fb8c275858b50785d657d092aac3e06e694490e7e4b5dd0ae1a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2081 Malicious code in @roku-web-ui/legacy-styleguide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 64351a60460f32a078a6792ac73191925335220106d05dc9d59eb22c56281b3d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sonahri51/orientation-change-end (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4e5ffc2c48c12f6b36620be282c6ed94826d434430e8412d70a220d4719b366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in grafana-metricsdrilldown-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76f0bf52430819b26f7b4042daedcdd27b0b6dcc7278385dac6989be16b987de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in npm-manifest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ade7d6d1c64c23c0b5ce1641cbe6a421ae5e995127affe277b05a6328ef012e1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the SearchQueryUtils function in the software for managing identity and access control in Keycloak allows a hacker to trigger a service denial.

The vulnerability of the SearchQueryUtils function in the Keycloak identity and access management software relates to improper external control of the file name or path. Exploiting this vulnerability could allow a malicious actor to cause service failures...

MAL-2025-1619 Malicious code in paypal-checkout-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8978fb3635d1339256e1aa90eab3f76ba33bad36f9a2ffd70d1f6fc7d60ccca8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...