Malicious code in template-vue-js (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in js-austt (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11373 Malicious code in js-austt (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-11218 Malicious code in openpass-sample-sites-client-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22761b2b3783be8fe56b0c5a6dcf9a5ad086a0be989ebb32123064f9800a7a1e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-17422 · WordPress · Wp Media Optimizer (.Webp) Plugin

Name of the Vulnerable Software and Affected Versions: WP Media Optimizer .webp plugin for WordPress versions up to, and including, 1.4.0 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated...

MAL-2024-11216 Malicious code in jsonwebtoken-js (npm)

This package is a starjacking attack which bundles a cryptostealing payload. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a67accf60cbc8a078a152decc08231110bf5a933476b286672b5cf53d042e35 Any computer that has this package installed or running should be considered...

GHSA-FWFX-RRV8-CRPF op_panic in the base runtime can force a panic in the runtime's containing thread

Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime. It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic = msg = throw new...

Directory Traversal

matrix-js-sdk is vulnerable to Directory Traversal. The vulnerability is due to insufficient validation of crafted MXC URIs, allowing a malicious room member to trigger arbitrary authenticated GET requests to the client's homeserver...

op_panic in the base runtime can force a panic in the runtime's containing thread

Affected versions use denocore releases that expose Deno.core.ops.oppanic to the JS runtime in the base core This function when called triggers a manual panic in the thread containing the runtime, breaking sandboxing It can be fixed by stubbing out the exposed op: javascript Deno.core.ops.oppanic...

CVE-2024-54134 @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material

A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots,...

CVE-2024-54134 @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material

A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots,...

CVE-2024-54134 @solana/web3.js modified package published to npm, containing malware that exfiltrates private key material

A publish-access account was compromised for @solana/web3.js, a JavaScript library that is commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious packages that were modified, allowing them to steal private key material and drain funds from dapps, like bots,...

Researchers Uncover Backdoor in Solana's Popular Web3.js npm Library

Cybersecurity researchers are alerting to a software supply chain attack targeting the popular @solana/web3.js npm library that involved pushing two malicious versions capable of harvesting users' private keys with an aim to drain their cryptocurrency wallets. The attack has been detected in...

solana/web3.js 信息泄露漏洞

solana/web3.js is a JavaScript library from Solana Labs. An information disclosure vulnerability exists in solana/web3.js versions 1.95.6 and 1.95.7, which stems from a vulnerability that allows an attacker to distribute unauthorized malicious packages that have been modified to steal private key...

PT-2024-10084 · Drupal +1 · Drupal +1

Name of the Vulnerable Software and Affected Versions: Minify JS versions 0.0.0 through 3.0.3 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the Minify JS module of the Drupal CMS system. This vulnerability can be exploited by a remote attacker to perform ...

Minify JS - Moderately critical - Cross site request forgery - SA-CONTRIB-2024-070

The Minify JS module allows a site administrator to minify all javascript files that exist in the site's code base and use those minified files on the front end of the website. Several administrator routes are unprotected against Cross-Site Request Forgery CRSF attacks...

Malicious code in @solana/web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 507e136eb7d13bd9c88a5e20d692768a759c2ae382d1ab54ba66c196b560cacb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11183 Malicious code in @solana/web3.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 507e136eb7d13bd9c88a5e20d692768a759c2ae382d1ab54ba66c196b560cacb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-9247 · Solana · @Solana/Web3.Js

Name of the Vulnerable Software and Affected Versions: @solana/web3.js versions 1.95.6 through 1.95.7 Description: A publish-access account was compromised for @solana/web3.js, a JavaScript library commonly used by Solana dapps. This allowed an attacker to publish unauthorized and malicious...

Cross-site Scripting (XSS)

Overview calibreweb is a Web app for browsing, reading and downloading eBooks stored in a Calibre database. Affected versions of this package are vulnerable to Cross-site Scripting XSS through the editbooks.js component due to improper user input sanitization. An attacker can inject malicious...