Malicious code in tq-assignment-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7f3696cd235e903c072e0f059768eac6d02449c0391742e708b6ce69250e1a15 The OpenSSF Package Analysis project identified 'tq-assignment-js' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

dingfanzu 跨站脚本漏洞

dingfanzu is a php-based food ordering website developed by gk2007, an individual developer. A cross-site scripting vulnerability exists in dingfanzu, which originates from the parameter address-name in the scripts/order.js file in the Order Checkout component and can lead to cross-site scripting...

Malicious code in kk4845.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38684730b01368b7ae01946765e8bb76b27127d47d68019c175e498d92f577fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8902 Malicious code in kk4845.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38684730b01368b7ae01946765e8bb76b27127d47d68019c175e498d92f577fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in zama1.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2afbc5173ad05196006544f59dceeb925749886b3658d14e9fe6ef4fc721c4b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8910 Malicious code in zama1.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2afbc5173ad05196006544f59dceeb925749886b3658d14e9fe6ef4fc721c4b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-7389 · Unknown +1 · Matrix-Js-Sdk +1

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions 9.11.0 through 34.7.0 Description: The issue is related to the MatrixClient.sendSharedHistoryKeys method in the matrix-js-sdk, which is vulnerable to interception by malicious homeservers. This method is used to share...

whatsapp-api-js fails to validate message's signature

Impact Incorrect Access Control, anyone using the post or verifyRequestSignature methods to handle messages is impacted. Patches Patched in version 4.0.3. Workarounds It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is...

CVE-2024-45607

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...

CVE-2024-45607 whatsapp-api-js fails to validate message's signature

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...

CVE-2024-45607 whatsapp-api-js fails to validate message's signature

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...

CVE-2024-45607

CVE-2024-45607 affects whatsapp-api-js, a TypeScript server-agnostic WhatsApp Official API framework. The issue is improper validation of request signatures in WhatsAppAPI.verifyRequestSignature, allowing incorrect access control by manipulating the signature verification process and potentially ...

CVE-2024-45607 whatsapp-api-js fails to validate message's signature

whatsapp-api-js is a TypeScript server agnostic Whatsapp's Official API framework. It's possible to check the payload validation using the WhatsAppAPI.verifyRequestSignature and expect false when the signature is valid. Incorrect Access Control, anyone using the post or verifyRequestSignature...

CBL Mariner 2.0 Security Update: js-jquery (CVE-2019-20149)

The version of js-jquery installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2019-20149 advisory. - ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attribute...

MAL-2024-8868 Malicious code in passports-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f07e6135ed2ddf89c87508abbc5a583e3ae22a8ae354dfd915c99471e01dbbd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in passports-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f07e6135ed2ddf89c87508abbc5a583e3ae22a8ae354dfd915c99471e01dbbd0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8862 Malicious code in bcrypts-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 119f108e696a505c0b232d8ee8e4919de05b9f92725dcc535747aea9290433ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bcrypts-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 119f108e696a505c0b232d8ee8e4919de05b9f92725dcc535747aea9290433ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cryptograph-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 344b01183d31f7bfbadedba12b2bfe4e733ea76938ea8976787f6c400b39f5a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8861 Malicious code in cryptograph-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 344b01183d31f7bfbadedba12b2bfe4e733ea76938ea8976787f6c400b39f5a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...