99 matches found
EUVD-2022-3868
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2019-16775
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of...
Malicious code in pre-and-postinstall-scripts-example (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4994e0104f427d4e6ac062c0ec26e609127db5c43b703a286194e39d36ae9e9 Any computer that has this package installed or running should be considered...
Embedded Malicious Package
Overview @xene/core is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private repositories, delete...
CVE-2024-55093
phpIPAM through 1.7.3 has a reflected Cross-Site Scripting XSS vulnerability in the install scripts...
CVE-2024-55093
phpIPAM through 1.7.3 has a reflected Cross-Site Scripting XSS vulnerability in the install scripts...
CVE-2024-55093
phpIPAM through 1.7.3 has a reflected Cross-Site Scripting XSS vulnerability in the install scripts...
CVE-2024-55093
phpIPAM through 1.7.3 has a reflected Cross-Site Scripting XSS vulnerability in the install scripts...
CVE-2024-55093
phpIPAM 1.7.3 has a reflected XSS vulnerability in the install scripts. The provided documents do not include exploitation details or a remediation/version fix.
CVE-2024-55093
phpIPAM through 1.7.3 has a reflected Cross-Site Scripting XSS vulnerability in the install scripts...
Node.js Users Beware: Manifest Confusion Attack Opens Door to Malware
The npm registry for the Node.js JavaScript runtime environment is susceptible to what's called a manifest confusion attack that could potentially allow threat actors to conceal malware in project dependencies or perform arbitrary script execution during installation. "A npm package's manifest is...
PT-2023-23592 · Wings · Wings
Name of the Vulnerable Software and Affected Versions: Wings versions prior to 1.7.5 Wings versions 1.11.0 through 1.11.5 Description: The issue affects Wings, allowing attackers to gain access to the host system if they can modify a server's install script or if the install script executes code...
SUSE CVE-2019-16776
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended nodemodules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or ga...
SUSE CVE-2020-5974
NVIDIA JetPack SDK, version 4.2 and 4.3, contains a vulnerability in its installation scripts in which permissions are incorrectly set on certain directories, which can lead to escalation of privileges...
CVE-2022-28859
On F5 BIG-IP 15.1.x versions prior to 15.1.5.1 and 14.1.x versions prior to 14.1.4.6, when installing Net HSM, the scripts nethsm-safenet-install.sh and nethsm-thales-install.sh expose the Net HSM partition password. Note: Software versions which have reached End of Technical Support EoTS are not...
postgresql: Uncontrolled search path element in CREATE EXTENSION
A flaw was found in PostgreSQL, where some PostgreSQL extensions did not use the searchpath safely in their installation script. This flaw allows an attacker with sufficient privileges to trick an administrator into executing a specially crafted script during the extension's installation or updat...
Malicious Package in 1337qq-js
All versions of 1337qq-js contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes: - Environment variables - Running processes - /etc/hosts - uname -a - npmrc file Recommendation Remove the packag...
Malicious Package in pizza-pasta
Version 1.0.3 of pizza-pasta contains malicious code as a install scripts. The package created folders in the system's Desktop and downloaded an image from imgur.com. The package also printed the users SSH keys to the console. Recommendation Remove the package from your environment. There are no...
GHSA-WXRM-2H86-V95F Malicious Package in pizza-pasta
Version 1.0.3 of pizza-pasta contains malicious code as a install scripts. The package created folders in the system's Desktop and downloaded an image from imgur.com. The package also printed the users SSH keys to the console. Recommendation Remove the package from your environment. There are no...
