Malicious code in @ms-atlas/datastudio-diagnostics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3f339799f51093d5209c8cdce0977b24869016867c813f0abcfc5143e81f921 The OpenSSF Package Analysis project identified '@ms-atlas/datastudio-diagnostics' @ 0.2.10 npm as malicious. It is considered malicious because...

MAL-2023-1255 Malicious code in nwa-uikit-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 90a7d076b934f9928aa5301f8d62f0218fd96a1f59a26102659ee688114d764a The OpenSSF Package Analysis project identified 'nwa-uikit-web' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

Lack Of IP Address Verification

github.com/IceWhaleTech/CasaOS-Gateway is vulnerable to Lack Of IP Address Verification. The vulnerability exists because the gatewayroute.go incorrectly checks the source of an IP, which allows an attacker to inject and execute malicious commands as root on a CasaOS instance...

FIN8 Group Using Modified Sardonic Backdoor for BlackCat Ransomware Attacks

The financially motivated threat actor known as FIN8 has been observed using a "revamped" version of a backdoor called Sardonic to deliver the BlackCat ransomware. According to the Symantec Threat Hunter Team, part of Broadcom, the development is an attempt on the part of the e-crime group to...

Malicious code in openai-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4ae52243725fa671be1294e1a3747581764b2e74d9c499e0ac249b03676d0dbf The OpenSSF Package Analysis project identified 'openai-beta' @ 99.99.999 npm as malicious. It is considered malicious because: - The package...

Malicious code in @obg/gtm.types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2c49019b18d394a7faef47a1333687dacb2f9e2489953e8eddf211df2733d496 The OpenSSF Package Analysis project identified '@obg/gtm.types' @ 99999.22222222.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1095 Malicious code in @obg/ngx.global (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 88f55cbace2fa2eb2e05fb52cd0e69c6a623b5b977a0d6638853b20fe1dac89f The OpenSSF Package Analysis project identified '@obg/ngx.global' @ 99999.0.0 npm as malicious. It is considered malicious because: - The packag...

CVE-2023-28365

A backup file vulnerability found in UniFi applications Version 7.3.83 and earlier running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored...

CVE-2023-28365

A backup file vulnerability found in UniFi applications Version 7.3.83 and earlier running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored...

CVE-2023-28365

Summary (verified): CVE-2023-28365 is a backup file vulnerability in UniFi applications (≤ 7.3.83) on Linux that allows an administrator to execute malicious commands on the host during a restore. The NVD entry lists a high-severity CVSSv3.1 base score (9.1) with network attack vector, high impac...

GHSA-H42J-MRMP-9369 git-commit-info vulnerable to Command Injection

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject arguments to the git...

CVE-2023-26134

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject malicious commands once...

Command Injection

keep-module-latest is vulnerable to command injection. The vulnerability exists in installModule function of index.js due to improper input sanitization, which allows an attacker to inject and execute malicious commands within the target environment...

Command Injection

n158 is vulnerable to command injection. The vulnerability exists in module.exports function of initProject.js due to improper input sanitization, which allows an attacker to inject and execute malicious commands within the target environment...

MAL-2023-1085 Malicious code in @mddsfmsdflm/itemselector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 88f4e295b9c4b793c8ffbdc4077606b6d5b61c41ab83b85bda2b46680c678174 The OpenSSF Package Analysis project identified '@mddsfmsdflm/itemselector' @ 103.0.9 npm as malicious. It is considered malicious because: - Th...

Malicious code in @mddsfmsdflm/itemselector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 88f4e295b9c4b793c8ffbdc4077606b6d5b61c41ab83b85bda2b46680c678174 The OpenSSF Package Analysis project identified '@mddsfmsdflm/itemselector' @ 103.0.9 npm as malicious. It is considered malicious because: - Th...

Malicious code in superagt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d417dfcd3054c03947066c9d5097e7bf561e9b05b055fd5e3caeea7275f4019f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pitito (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c402c7c9c4bff455910dd1b71d4c8d9cb7e47b0daa68d4d68eedf1649965afb7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opbox-seller-shop-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c62594db29ca0473a517e2d3ed643575d938a4d43a58ee4420b2b304b8121b32 The OpenSSF Package Analysis project identified 'opbox-seller-shop-service' @ 99.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in opbox-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4711ddc1c31860a921bc52eb8e87d8e43815d791684cedb6686ac77c65cc7125 The OpenSSF Package Analysis project identified 'opbox-web' @ 99.0.0 npm as malicious. It is considered malicious because: - The package...