nodejs-json-schema: Prototype pollution vulnerability

The json-schema Node.JS library was vulnerable to prototype pollution during the validation of a JSON object. An attacker, able to provide a specially crafted JSON file for validation, could use this flaw to modify the behavior of the node program, to, for example, execute arbitrary code...

nodejs: Improper handling of URI Subject Alternative Names

A flaw was found in node.js where it accepted a certificate's Subject Alternative Names SAN entry, as opposed to what is specified by the HTTPS protocol. This flaw allows an active person-in-the-middle to forge a certificate and impersonate a trusted host...

OSV-2022-514 Heap-use-after-free in AK::HashTable<AK::StringView, AK::Traits<AK::StringView>, false>::try_lookup_for

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=48405 Crash type: Heap-use-after-free READ 2 Crash state: AK::HashTable, false::trylookupfor JS::Parser::isprivateidentifiervalid JS::Parser::parseprimaryexpression...

Malicious Package

Overview ethmoji-js-demo is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious Package

Overview mapray-js-monorepo is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this packag...

Malicious Package

Overview ethers-js-snap is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious Package

Overview oms-js-utils is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview ddc-classnames-js is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious code in ethmoji-js-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34b3e9fb116b32c332ccbd4ad178a22a8aad613494a223d2fba755ff689eaad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2877 Malicious code in ethmoji-js-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34b3e9fb116b32c332ccbd4ad178a22a8aad613494a223d2fba755ff689eaad1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Server-side Request Forgery (SSRF)

Overview link-preview-js is a Javascript module to extract and fetch HTTP link information from blocks of text. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF which allows attackers to send arbitrary requests to the local network and read the response. This i...

WordPress Download Manager 3.2.43 Cross Site Scripting

Exploit Title: Download Manager Cross-Site Scripting Date: 2022-06-16 Exploit Author : Andrea Bocchetti Vendor Homepage : https://wordpress.org/plugins/download-manager/ Version : = 3.2.43 Tested on: windows CVE : CVE-2022-2101 Description 1- Login in the plugin page 2- add the xss payload in the...

nodejs: Incorrect handling of certificate subject and issuer fields

A flaw was found in node.js, where it did not properly handle multi-value Relative Distinguished Names. This flaw allows a specially crafted x509 certificate to produce a false multi-value Relative Distinguished Name and to inject arbitrary data in node.js libraries...

Malicious code in cart-client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e2856576c4df628bed193bb9ad1d6223d7ac9f81f4e5592cfe77c531f9bfcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1833 Malicious code in cart-client-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e2856576c4df628bed193bb9ad1d6223d7ac9f81f4e5592cfe77c531f9bfcf4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in medicare-common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f29c05d6cee577d5f86a2a760c23578b65068f7e091dc6519990f798f42d30a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4539 Malicious code in medicare-common-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f29c05d6cee577d5f86a2a760c23578b65068f7e091dc6519990f798f42d30a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in hb-analytics-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12eee3dc0ffc0d3745b6a4c59df442b805eb59386b63660250622af4f839abc5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3570 Malicious code in hb-analytics-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12eee3dc0ffc0d3745b6a4c59df442b805eb59386b63660250622af4f839abc5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-143 Malicious code in @boosted-bounty/firebase-helpers-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 948a8d680d689630aad1614e4a8b58cad4c431fb2d9e87887c4055879595ae95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...