155 matches found
CVE-2026-110765 FlexPrice through 2.1.38 QuickBooks Webhook Signature Verification Bypass
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly ad...
CVE-2026-110765
Versions of FlexPrice up to and including 2.1.38 are vulnerable to an authentication bypass in the HandleQuickBooksWebhook function. The root cause is the failure to verify the intuit-signature header when it is omitted. An unauthenticated attacker who possesses a tenant ID and environment ID can...
EUVD-2026-101565
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly ad...
PT-2026-114129
FlexPrice through 2.1.38 contains an authentication bypass vulnerability in HandleQuickBooksWebhook that skips signature verification when the intuit-signature header is omitted. Unauthenticated attackers knowing a tenant and environment ID can replay forged payment notifications to repeatedly ad...
Malicious code in intuit-test (npm)
Source: amazon-inspector d5c288ee5b3be1ea0c5734b9981a53efd3a6bb88608d7611b2bd9e3b20353591 The package intuit-test was found to contain malicious code. --- Credit: OpenSSF source...
Malware in intuit-authz
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malware in one-intuit-help-system-utils
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in one-intuit-help-system-utils (npm)
Source: amazon-inspector 4c22e9eaa97b1ee548e6ca6ac6257ea72fed0ee92d5b54255781e62b8ae19783 package.json declares a dependency whose key equals the package's own name one-intuit-help-system-utils and whose value is a bare HTTPS URL https://repo.securityctrl.com/one-intuit-help-system-utils rather...
Malicious Package
Overview one-intuit-help-system-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious code in intuit-authz (npm)
Source: amazon-inspector 68a4d159209bece0d5b390b92e1d7a9a10496022056de8da653ea5572acc8fe7 package.json at line 11 declares a self-named dependency intuit-authz whose source is the bare HTTPS URL https://repo.securityctrl.com/intuit-authz instead of a semver range resolved through the npm registry...
Malicious Package
Overview intuit-authz is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-15517 Malicious code in one-intuit-help-system-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c22e9eaa97b1ee548e6ca6ac6257ea72fed0ee92d5b54255781e62b8ae19783 package.json declares a dependency whose key equals the package's own name one-intuit-help-system-utils and whose value is a bare HTTPS URL...
Malicious code in one-intuit-help-system-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4c22e9eaa97b1ee548e6ca6ac6257ea72fed0ee92d5b54255781e62b8ae19783 package.json declares a dependency whose key equals the package's own name one-intuit-help-system-utils and whose value is a bare HTTPS URL...
Malicious code in intuit-authz (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68a4d159209bece0d5b390b92e1d7a9a10496022056de8da653ea5572acc8fe7 package.json at line 11 declares a self-named dependency intuit-authz whose source is the bare HTTPS URL https://repo.securityctrl.com/intuit-authz...
MAL-2026-15511 Malicious code in intuit-authz (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 68a4d159209bece0d5b390b92e1d7a9a10496022056de8da653ea5572acc8fe7 package.json at line 11 declares a self-named dependency intuit-authz whose source is the bare HTTPS URL https://repo.securityctrl.com/intuit-authz...
JLSEC-2026-14
An issue was discovered in GNU patch through 2.7.6. There is a segmentation fault, associated with a NULL pointer dereference, leading to a denial of service in the intuitdifftype function in pch.c, aka a "mangled rename" issue...
CVE-2018-14833
Intuit Lacerte 2017 has Incorrect Access Control...
MAL-2025-192805 Malicious code in intuit-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5c288ee5b3be1ea0c5734b9981a53efd3a6bb88608d7611b2bd9e3b20353591 The package intuit-test was found to contain malicious code...
Malicious code in intuit-test (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5c288ee5b3be1ea0c5734b9981a53efd3a6bb88608d7611b2bd9e3b20353591 The package intuit-test was found to contain malicious code...