28 matches found
Malicious code in jiklpo-tsunari-kay (PyPI)
Source: kam193 82ef4d01da7de20aa2e477bb07e1daa97855cdf33d186579da5cf148e3d4be0e The package uses fake http-downloaded dependencies to track downloads, and has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but also anything that looks like testin...
Malicious Package
Overview jiklpo-tsunari-kay is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MAL-2026-18113 Malicious code in jiklpo-tsunari-kay (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2df8ddef194a109b65d938d86371d9e97c84ea4c8863af380fb495508ce5a90 setup.py declares installrequires="object-handle-logger-table @ https://artifacts.yosiroute.com/pypi/objecthandleloggertable-1.0.0.tar.gz", resolving...
Malicious code in jiklpo-tsunari-kay (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2df8ddef194a109b65d938d86371d9e97c84ea4c8863af380fb495508ce5a90 setup.py declares installrequires="object-handle-logger-table @ https://artifacts.yosiroute.com/pypi/objecthandleloggertable-1.0.0.tar.gz", resolving...
CVE-2025-32162: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Morgan Kay Chamber Dashboard Business Directory allows DOM-Based XSS. This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.11...
CVE-2025-23917: Missing Authorization
Missing Authorization vulnerability in Chandrika Guntur, Morgan Kay Chamber Dashboard Business Directory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Chamber Dashboard Business Directory: from n/a through 3.3.8...
kay-page.com Cross Site Scripting vulnerability OBB-3902410
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
kay-kieserling.de Improper Access Control vulnerability OBB-3773634
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
CVE-2022-37405
Cross-Site Request Forgery CSRF vulnerability in Mickey Kay's Better Font Awesome plugin = 2.0.1 at WordPress...
kay (0.1.0) potentially affected by CVE-2020-36433 via chunky (0.1.4)
chunky CARGO version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on chunky and may be impacted: - kay 0.1.0 Source cves: CVE-2020-36433 Source advisory: GHSA-QG24-8XJ4-GJ2H...
kay (0.1.0) potentially affected by CVE-2020-36433 via chunky (0.1.4)
chunky CARGO version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on chunky and may be impacted: - kay 0.1.0 Source cves: CVE-2020-36433 Source advisory: OSV:GHSA-QG24-8XJ4-GJ2H...
kay (0.1.0) potentially affected by CVE-2020-36433 via chunky (0.1.4)
chunky CARGO version 0.1.4 is affected by a known vulnerability. The following packages have a transitive dependency on chunky and may be impacted: - kay 0.1.0 Source cves: CVE-2020-36433 Source advisory: OSV:RUSTSEC-2020-0035...
Zeta Components Mail 1.8.1 - Remote Code Execution
Zeta Components Mail 1.8.1 - Remote Code Execution Vendor: Zeta Components module: Mail, returnPath-email”; If attacker assign email address like: '[email protected] -X/var/www/html/cache/exploit.php' and inject payload in mail body, sendmail will transfer log-X into...
Zeta Components Mail 1.8.1 - Remote Code Execution
Vendor: Zeta Components module: Mail, returnPath-email”; If attacker assign email address like: '[email protected] -X/var/www/html/cache/exploit.php' and inject payload in mail body, sendmail will transfer log-X into /var/www/html/cache/exploit.php. The resulting file will contain t...
Mary Kay® Virtual Makeover - Dangerous filesystem permissions, Insecure KeyStore vulnerabilities
HackApp vulnerability scanner discovered that application Mary Kay® Virtual Makeover published at the 'play' market has multiple vulnerabilities...
extension): MITM due to improper validation of AX attribute signatures
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...
extension): MITM due to improper validation of AX attribute signatures
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...
DEBIAN-CVE-2011-4314
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...
Input validation
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...
CVE-2011-4314
message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange AX information is signed, which allows remote attackers to modify...