Malicious code in excaliburx (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d763da65172935a20c3b03c65deff16a2eb251d857d1fc34e4cc67b72f7610a Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2023-8767 Malicious code in newpackagetest2027 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7c1e4acddbaeafd87b1cce82ddc1025a3e5abd4c285a2fd2e7fcff07d37d500e Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

Malicious code in @dle-clo-bento-component/dist (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a652e8cb279a3db5d1420008c3f3fc8c11aab4463f7ed61925ca409f18066b19 The OpenSSF Package Analysis project identified '@dle-clo-bento-component/dist' @ 13.0.0 npm as malicious. It is considered malicious because: -...

CVE-2023-48299

TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the...

CVE-2023-48299 TorchServe ZipSlip

TorchServe is a tool for serving and scaling PyTorch models in production. Starting in version 0.1.0 and prior to version 0.9.0, using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the...

TorchServe ZipSlip

Impact Using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in...

GHSA-M2MJ-PR4F-H9JP TorchServe ZipSlip

Impact Using the model/workflow management API, there is a chance of uploading potentially harmful archives that contain files that are extracted to any location on the filesystem that is within the process permissions. Leveraging this issue could aid third-party actors in hiding harmful code in...

NetworkAssessment - With Wireshark Or TCPdump, You Can Determine Whether There Is Harmful Activity On Your Network Traffic That You Have Recorded On The Network You Monitor

The Network Compromise Assessment Tool is designed to analyze pcap files to detect potential suspicious network traffic. This tool focuses on spotting abnormal activities in the network traffic and searching for suspicious keywords. DNS Tunneling Detection : Identifies potential covert...

Cross Site Scripting (XSS)

pimcore/admin-ui-classic-bundle is vulnerable to Cross Site Scripting. The vulnerability is due to the getPreviewDocumentAction function in AssetController.php not having any content validation for PDF files. This allows an attacker to craft a malicious PDF file containing harmful scripts and can...

Design/Logic Flaw

In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replacing a resource script file created by an instruction at run time with a malicious script. The 1E Client's temporary directory is now locke...

CVE-2023-45160 Elevated Temp Directory Execution in 1E Client

In the affected version of the 1E Client, an ordinary user could subvert downloaded instruction resource files, e.g., to substitute a harmful script. by replacing a resource script file created by an instruction at run time with a malicious script. The 1E Client's temporary directory is now locke...

Malicious code in optimize-procurement-and-inventory-with-ai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d4a974419b1ab87d44f6d1c5cfd7fac97f037b476328f114d344113cf6bbd6f The OpenSSF Package Analysis project identified 'optimize-procurement-and-inventory-with-ai' @ 6.1.8 npm as malicious. It is considered maliciou...

Multiple Self-XSS Vulnerabilites

Description Multiple Self-XSS Vulnerabilities are triggered at multiple endpoints. http://localhost:8083/edit/server/ There is a bug in web/templates/pages/editserver.php file. Attacker can control $vtimezone. php ', theme: '', language: '', hasSmtpRelay: , remoteBackupEnabled: , backupType: '',...

Malicious code in puppeteer-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86dc3a8e94227c886be1f23f2acbcbfcf8e01dd2664461ea24aff9236351b195 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zara-mkt-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 63035f09a78f784aa3cc30ea29d7a7508c1811c6f344d00b42e93338f2cb50c5 The OpenSSF Package Analysis project identified 'zara-mkt-core' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in visual_components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7289e2b3846c5d4eacbe709a4bd08a2e48688e587b810b9535c2275275dd2497 The OpenSSF Package Analysis project identified 'visualcomponents' @ 1.0.13 npm as malicious. It is considered malicious because: - The package...

PT-2023-23609 · Gitlab · Gitlab

Name of the Vulnerable Software and Affected Versions: GitLab versions 15.11 through 16.1.4 GitLab versions 16.2 through 16.2.4 GitLab versions 16.3 through 16.3.0 Description: An issue has been discovered in GitLab where an authenticated user could trigger a denial of service when importing or...

Malicious code in wallet-add-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f669adaac6e6303053b5a1d293a7250bd6a4f8e3c3fa52f941d1a1c4497955a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Update for Microsoft Visual Studio Code Cloudfoundry Manifest YML Support Extension (CVE-2022-31691)

The Microsoft Visual Studio Code Cloudfoundry Manifest YML Support Extension is version 1.39.0 or below. It is, therefore, affected by a remote code execution vulnerability. The extension uses the Snakeyaml library for YAML editing support. This library allows for some special syntax in the YAML...

Malicious code in twentytwenty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0b5cb94b4e758aaabd499e42ac5e149391b5f11597501e5df504661a2d633122 The OpenSSF Package Analysis project identified 'twentytwenty' @ 1.9.1 npm as malicious. It is considered malicious because: - The package...