PT-2020-21431

Name of the Vulnerable Software and Affected Versions scroool version 0.1.7 Description The issue concerns malicious code in version 0.1.7 of scroool that, when executed in a browser, extracts sensitive information such as password, cvc, and cardnumber fields from forms and sends this data to the...

PT-2020-21153

Name of the Vulnerable Software and Affected Versions diagram-js versions prior to 3.3.1 diagram-js versions prior to 2.6.2 Description The issue concerns the failure to escape output of user-controlled input in the search-pad, allowing attackers to execute arbitrary JavaScript, which can lead to...

PT-2020-20952

Name of the Vulnerable Software and Affected Versions ember-power-timepicker version 1.0.8 Description The issue concerns malicious code in the ember-power-timepicker package that, when executed in a browser, can extract sensitive information such as password, cvc, and card number fields from...

PT-2020-20971

Name of the Vulnerable Software and Affected Versions motiv.scss version 0.4.20 Description The issue concerns malicious code in a specific version of motiv.scss. When executed in a browser, this code can extract sensitive information such as password, cvc, and cardnumber fields from forms and se...

PT-2020-20973

Name of the Vulnerable Software and Affected Versions ng-ui-library version 1.0.987 Description The issue concerns malicious code in the ng-ui-library that, when executed in a browser, can extract sensitive information such as password, cvc, and cardnumber fields from forms. This extracted data i...

@acanto/october-scripts (3.2.2), @acanto/workflow (5.1.0) +332 more potentially affected by CVE-2020-7733 via ua-parser-js (>=0.6.2, <=0.7.21)

ua-parser-js NPM version =0.6.2, =0.16.9, =2018.7.11-0, =2.0.1, =1.0.0-beta.11, =2.0.0-beta.1, =1.0.0, =5.0.0, =2.6.6, =6.6.0, =3.0.1, =0.1.3, =0.3.8 - @chessboard/nwb 0.25.3-next.0 and more Source cves: CVE-2020-7733 Source advisory: SNYK:JS-UAPARSERJS-610226...

Regular Expression Denial of Service (ReDoS)

Overview ua-parser-js is a lightweight JavaScript-based user-agent string parser. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the regex for Redmi Phones and Mi Pad Tablets UA. POC by Yeting Li var blank = " "; for let i = 1; i 5000; i++ blank...

@makeomatic/confidence (5.0.0), @makeomatic/deploy (>=10.0.1, <=10.2.1) +6 more potentially affected by unknown CVE via @hapi/hoek (9.0.2)

@hapi/hoek NPM version 9.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on @hapi/hoek and may be impacted: - @makeomatic/confidence 5.0.0 - @makeomatic/deploy =10.0.1, =6.0.0, =15.0.0, =10.0.0, =8.0.0, =14.0.0, =6.1.2, =6.8.3 Source cves: unknown CVE...

GHSA-7WGH-5Q4Q-6WX5 Malicious Package in 1337qq-js

All versions of 1337qq-js contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes: - Environment variables - Running processes - /etc/hosts - uname -a - npmrc file Recommendation Remove the packag...

Malicious Package in 1337qq-js

All versions of 1337qq-js contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes: - Environment variables - Running processes - /etc/hosts - uname -a - npmrc file Recommendation Remove the packag...

PT-2020-21134

Name of the Vulnerable Software and Affected Versions 1337qq-js versions all versions Description The issue concerns malicious code within the 1337qq-js package that targets UNIX systems. This code exfiltrates sensitive information, including environment variables, running processes, the contents...

Malicious Package

All versions of 1337qq-js contain malicious code. The package exfiltrates sensitive information through install scripts. It targets UNIX systems. The information exfiltrated includes: - Environment variables - Running processes - /etc/hosts - uname -a - npmrc file Remove the package from your...

GHSA-H6M3-CX24-9626 Malicious Package in js-sla3

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised...

Malicious Package in js-sja3

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised...

GHSA-6343-M2QR-66GF Malicious Package in js-sja3

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised...

GHSA-3MHM-JVQJ-FVHG Malicious Package in js-sia3

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised...

Malicious Package in js-shq3

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised...

GHSA-766V-7GJX-55HF Malicious Package in js-shq3

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised...

GHSA-F8JJ-45FJ-44R6 Malicious Package in js-she3

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised...

Malicious Package in js-sha7

Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised...