MAL-2023-8763 Malicious code in enchantv (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f578b605e73b68aae8c1d8a9bd3f55b810839b2bccd720bccc7f887c2e0046c8 Packages either test the malicious behaviour, or actually download and run a simple remote script during the installation. --- Category: PROBABLYPENTEST -...

MAL-2023-8692 Malicious code in @dle-multiform-angular-component/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 820657ccb39c885de6a5d6006ee75064ffa46699e8af105375b12a67436649fc The OpenSSF Package Analysis project identified '@dle-multiform-angular-component/core' @ 13.0.1 npm as malicious. It is considered malicious...

Malicious code in bitboxapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5ac7326795e975d78c457b2260890b2b63220fd6ae8491a0f86708c32fddd1b9 The OpenSSF Package Analysis project identified 'bitboxapp' @ 1.9.0 npm as malicious. It is considered malicious because: - The package...

CVE-2023-48863

SEMCMS 3.9 is vulnerable to SQL Injection. Due to the lack of security checks on the input of the application, the attacker uses the existing application to inject malicious SQL commands into the background database engine for execution, and sends some attack codes as commands or query statements...

CVE-2023-42004

IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection. A remote attacker could execute malicious commands due to improper validation of csv file contents. IBM X-Force ID: 265262...

CVE-2023-42004 IBM Security Guardium CSV injection

IBM Security Guardium 11.3, 11.4, and 11.5 is potentially vulnerable to CSV injection. A remote attacker could execute malicious commands due to improper validation of csv file contents. IBM X-Force ID: 265262...

SQL Injection

hoteldruid is vulnerable to SQL Injection. The vulnerability is due to there is no sanitization of user inputs in idutentelog POST parameter. This allows an attacker to inject malicious SQL commands, and potentially leads to unauthorized data access...

SQL Injection

hoteldruid is vulnerable to SQL injection. The vulnerability is due to there is no sanitization of user inputs in numcaselle POST parameter. This allows an attacker to inject malicious SQL commands, and potentially leads to unauthorized data access...

Malicious code in ory-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97e67d3893cb4ea477e80d85d47524af218e6579c6e04ed4037580b05b45060d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wehackreposss (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 886efcb413ccb918dc087a951fa61416e8b1175b0ea3009a4e273b62067fe385 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @atea/common-design-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2329fd9b04f0c2f8d8db0bf754737afd91b53c559c6dfa3aaf3c1f337323f9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xterm-addon-unicode-graphemes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1e517091262ed409fb53011792754e279673a300f5e9abf2377eec73ed814f9c The OpenSSF Package Analysis project identified 'xterm-addon-unicode-graphemes' @ 6.0.6 npm as malicious. It is considered malicious because: -...

Command Injection

Node-qpdf are vulnerable to Command Injection.The vulnerability is due to not sanitizing the input parameters in the encrypt method. This allows an attacker to inject malicious commands if they can specify the input pdf file path...

Malicious code in xsolla-paystation-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 805042517f32c5bf86be354525e626c93152ff256ee91fc9cdf74042868bae95 The OpenSSF Package Analysis project identified 'xsolla-paystation-widget' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Command injection

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the...

CVE-2023-26155

All versions of the package node-qpdf are vulnerable to Command Injection such that the package-exported method encrypt fails to sanitize its parameter input, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once they can specify the...

Malicious code in supabase.dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1e4679a0e55bb3adb8bc5aeca3ec47f21c782577c2dd593eaec5ea376d29977c The OpenSSF Package Analysis project identified 'supabase.dev' @ 4.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8302 Malicious code in @siigo-arquitectura/button-atom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10fd520d1b3077c01e859228a807bb4d066d090fa3e1d1b287389a9f45d58a78 The OpenSSF Package Analysis project identified '@siigo-arquitectura/button-atom' @ 5.0.7 npm as malicious. It is considered malicious because: ...

Sprecher Automation SPRECON-E Improper Neutralization of Special Elements used in a Command (CVE-2020-11496)

Sprecher SPRECON-E firmware prior to 8.64b might allow local attackers with access to engineering data to insert arbitrary code. This firmware lacks the validation of the input values on the device side, which is provided by the engineering software during parameterization. Attackers with access ...

Malicious code in goingwithflow (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 820652459a96bb4b499ab8430bae2e52c0da5f864e093be1047269c2cb98de91 The OpenSSF Package Analysis project identified 'goingwithflow' @ 9.8.9 npm as malicious. It is considered malicious because: - The package...