Malicious code in code-debug-codes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c78c334cc38295767013c4a8b7bd904fd09069e4b7f938183d8c247eefb27bec The OpenSSF Package Analysis project identified 'code-debug-codes' @ 9.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1469 Malicious code in flowtorch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6c2c3f2d7423991d07fec2693f59f64eaa2f3a3d0122fbf6f05e19a6d2a40871 The OpenSSF Package Analysis project identified 'flowtorch' @ 9.2.2 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1448 Malicious code in bobikssf (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1de7038e3065022e6f037bf1f47954a55f4752e0ebed75979cb78f31568b7d16 The OpenSSF Package Analysis project identified 'bobikssf' @ 0.4 pypi as malicious. It is considered malicious because: - The package communicat...

Malicious code in nequi-ci-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 48d27c14149e644219b408d1a24d84b1434d32c4d0d398bf4037d3321b078c38 The OpenSSF Package Analysis project identified 'nequi-ci-utils' @ 0.2.4 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1246 Malicious code in nequi-ci-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 48d27c14149e644219b408d1a24d84b1434d32c4d0d398bf4037d3321b078c38 The OpenSSF Package Analysis project identified 'nequi-ci-utils' @ 0.2.4 npm as malicious. It is considered malicious because: - The package...

GHSA-2GGP-CMVM-F62F ScanCode.io command injection in docker image fetch process

Command Injection in docker fetch process Summary A possible command injection in the docker fetch process as it allows to append malicious commands in the dockerreference parameter. Details In the function scanpipe/pipes/fetch.py:fetchdockerimage1 the parameter dockerreference is user...

ScanCode.io command injection in docker image fetch process

Command Injection in docker fetch process Summary A possible command injection in the docker fetch process as it allows to append malicious commands in the dockerreference parameter. Details In the function scanpipe/pipes/fetch.py:fetchdockerimage1 the parameter dockerreference is user...

Malicious code in hellodependency4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6ee690a1802b2ec1b8112926bc08ca611e8aaeb56abfd231a01d22b8d89f010c The OpenSSF Package Analysis project identified 'hellodependency4' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in @ms-atlas/datastudio (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c1a0ed2d0fd6cab78604fbbbc988dcc649199fe0062a5ddff4a79dc1a8d9ef6 The OpenSSF Package Analysis project identified '@ms-atlas/datastudio' @ 0.1.21 npm as malicious. It is considered malicious because: - The...

Malicious code in @ms-atlas/datastudio-diagnostics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a3f339799f51093d5209c8cdce0977b24869016867c813f0abcfc5143e81f921 The OpenSSF Package Analysis project identified '@ms-atlas/datastudio-diagnostics' @ 0.2.10 npm as malicious. It is considered malicious because...

MAL-2023-1255 Malicious code in nwa-uikit-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 90a7d076b934f9928aa5301f8d62f0218fd96a1f59a26102659ee688114d764a The OpenSSF Package Analysis project identified 'nwa-uikit-web' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...

Lack Of IP Address Verification

github.com/IceWhaleTech/CasaOS-Gateway is vulnerable to Lack Of IP Address Verification. The vulnerability exists because the gatewayroute.go incorrectly checks the source of an IP, which allows an attacker to inject and execute malicious commands as root on a CasaOS instance...

FIN8 Group Using Modified Sardonic Backdoor for BlackCat Ransomware Attacks

The financially motivated threat actor known as FIN8 has been observed using a "revamped" version of a backdoor called Sardonic to deliver the BlackCat ransomware. According to the Symantec Threat Hunter Team, part of Broadcom, the development is an attempt on the part of the e-crime group to...

Malicious code in openai-beta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4ae52243725fa671be1294e1a3747581764b2e74d9c499e0ac249b03676d0dbf The OpenSSF Package Analysis project identified 'openai-beta' @ 99.99.999 npm as malicious. It is considered malicious because: - The package...

Malicious code in @obg/gtm.types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2c49019b18d394a7faef47a1333687dacb2f9e2489953e8eddf211df2733d496 The OpenSSF Package Analysis project identified '@obg/gtm.types' @ 99999.22222222.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1095 Malicious code in @obg/ngx.global (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 88f55cbace2fa2eb2e05fb52cd0e69c6a623b5b977a0d6638853b20fe1dac89f The OpenSSF Package Analysis project identified '@obg/ngx.global' @ 99999.0.0 npm as malicious. It is considered malicious because: - The packag...

CVE-2023-28365

A backup file vulnerability found in UniFi applications Version 7.3.83 and earlier running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored...

CVE-2023-28365

A backup file vulnerability exists in UniFi applications (Version 7.3.83 and earlier) running on Linux operating systems. This flaw allows application administrators to execute malicious commands on a host device during the restoration process. The vulnerability is associated with CWE-77 (Command...

CVE-2023-28365

A backup file vulnerability found in UniFi applications Version 7.3.83 and earlier running on Linux operating systems allows application administrators to execute malicious commands on the host device being restored...

GHSA-H42J-MRMP-9369 git-commit-info vulnerable to Command Injection

Versions of the package git-commit-info before 2.0.2 are vulnerable to Command Injection such that the package-exported method gitCommitInfo fails to sanitize its parameter commit, which later flows into a sensitive command execution API. As a result, attackers may inject arguments to the git...