Command Injection

gogs.io/gogs is vulnerable to Command Injection. The vulnerability is caused by improper input validation or sanitization during the tagging process of a new release. Attackers can exploit this issue by injecting malicious commands or additional arguments into the tagging command, which may be...

Malicious code in auth0-mailchimp-export (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c2f2ab30602da138b3668767294a045502dabcc11b0db0aa9c89dd18de4ab0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7049 Malicious code in @yu-life/yulife-bdd-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8dfe091de922cc251578223955b74b56ade98fa67b719bcaa584d3403602f992 The OpenSSF Package Analysis project identified '@yu-life/yulife-bdd-framework' @ 0.0.72 npm as malicious. It is considered malicious because: -...

Malicious code in internal-udfc-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 25708e4f5f0536339a12c9bf28e659c821359f2733ff51d193cd6d74443c3650 The OpenSSF Package Analysis project identified 'internal-udfc-pkg' @ 5.5.5 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1621 Malicious code in delta0231 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7df399fa1580fb8e64d7cd2481b0212f607aa8146a1b904b83a7af05ebb8031b The OpenSSF Package Analysis project identified 'delta0231' @ 100.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-1590 Malicious code in ing-feat-lu-luxtrust-smartcard-authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e101f8c803c8ca5e2fddab02abc82d9de8ce89fd23fb6f52bc2fd31a73c0fa01 The OpenSSF Package Analysis project identified 'ing-feat-lu-luxtrust-smartcard-authentication' @ 200.0.1 npm as malicious. It is considered...

Malicious code in cosma-ui-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 49388262dd0b3d40b1f426a488f94937d409f2ce2053702f81a099fa8ed3b3c2 The OpenSSF Package Analysis project identified 'cosma-ui-icons' @ 9999.999.3 npm as malicious. It is considered malicious because: - The packag...

Malicious code in @ing-caf/cdn-proxy-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 24ccbe0b13f81d2fe8d285bab144167d33f7b4e167833ebf615411db6d318eb6 The OpenSSF Package Analysis project identified '@ing-caf/cdn-proxy-plugin' @ 200.0.2 npm as malicious. It is considered malicious because: - Th...

GHSA-8J42-PCFM-3467 SQL injection in litellm

A blind SQL injection vulnerability exists in the berriai/litellm application, specifically within the '/team/update' process. The vulnerability arises due to the improper handling of the 'userid' parameter in the raw SQL query used for deleting users. An attacker can exploit this vulnerability b...

Malicious code in pentesters987abc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c42f65f70dff1af7f6a44a0622052e7a0f92113d52a9eb1258c158f1ff2ad27d The OpenSSF Package Analysis project identified 'pentesters987abc' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

RedTail Crypto-Mining Malware Exploiting Palo Alto Networks Firewall Vulnerability

The threat actors behind the RedTail cryptocurrency mining malware have added a recently disclosed security flaw impacting Palo Alto Networks firewalls to its exploit arsenal. The addition of the PAN-OS vulnerability to its toolkit has been complemented by updates to the malware, which now...

CVE-2024-2422: Improper Neutralization of Argument Delimiters in a Command

LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands...

Malicious code in frontend-datatable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3c7c2e13212e99fdaaa2039f7c837f80d08d0a6510e315a3db617cf16f49b477 The OpenSSF Package Analysis project identified 'frontend-datatable' @ 1.2.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in by-fetch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbe17032deb287c69fb57c7e240590cb829a046c49e904b65d01686694636d5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in elk-uikit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis aaece47ca73a2646b0cb728b7816026ec3135f48e18054950dce89f8bf9073b0 The OpenSSF Package Analysis project identified 'elk-uikit' @ 99.99.1 npm as malicious. It is considered malicious because: - The package execut...

Malicious code in not-exist-lykos-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a4ae62646ef95a3157dcd61e8c0f58a25bec2c826d45f514c6e7bffde0126d4 The OpenSSF Package Analysis project identified 'not-exist-lykos-poc' @ 66.6.6 npm as malicious. It is considered malicious because: - The packa...

CVE-2024-1520 OS Command Injection in parisneo/lollms-webui

An OS Command Injection vulnerability exists in the '/opencodefolder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussionid' parameter. Attackers can exploit this vulnerability by injecting malicious OS commands, leading to...

Malicious code in nespresso-bi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ecb1d1aad101d1cf5bdd8986e77fa20c75f039412cec1ebe03442f8fec9f939 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in qlik-sense-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 65fd03500a82dc6ac997cdeb7275cc6c67cae34d382b293886407c96166bc357 The OpenSSF Package Analysis project identified 'qlik-sense-dev' @ 5.9.991 npm as malicious. It is considered malicious because: - The package...

Malicious code in soundcloud-songs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1a7a5bdeca432ac351a71a0caac1e58d2f4d31d54fcf357f657e84d8f201f16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...