3406 matches found
MAL-2025-51249 Malicious code in candra-tempe5-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 310f2cd40c8dd4a050509d9f3cac094c66e5ae1eb3c7bc61a02cf7b83b18ae31 The package candra-tempe5-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...
MAL-2025-52619 Malicious code in vera-sego6-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0f8d542449f3d7ed07d67aead0a3988e8fed2902dc69da41c9ccfd35caf6db7 The package vera-sego6-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded n...
Malicious code in dewi-lepet59-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d9e316c9be55841b614c08a60e4d89b5a953055bc3ddd2c5546ec713d4d3acd The package dewi-lepet59-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...
MAL-2025-51690 Malicious code in eko-sambel78-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f145ee0cb59fc1efcccc6862a2024e2c1f375a206831ae9838f35c1d20765bd7 The package eko-sambel78-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...
MAL-2025-51699 Malicious code in eko-tempe58-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e68c8afede7239aebf486de68ae5d51dc7c3e61f466768cd3da7e12b69ee6b0 The package eko-tempe58-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...
MAL-2025-50843 Malicious code in arif-botok50-miaww (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5639c9a66f8d76fe1296b151e8b459a82be4a70b1df6bc88fc8b6e09e9fa5b37 The package arif-botok50-miaww was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...
CVE-2025-64343
conda Constructor is a tool that enables users to create installers for conda package collections. In versions 3.12.2 and below, the installation directory inherits permissions from its parent directory. Outside of restricted directories, the permissions are very permissive and often allow write...
CVE-2025-58337
An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized...
Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode
An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized...
CVE-2025-58337
The Apache Doris-MCP-Server (an Enterprise-grade Model Context Protocol server for Apache Doris) is vulnerable to Improper Access Control (CWE-284). An attacker possessing a valid read-only account can bypass the server's read-only mode due to the improper enforcement of access controls for SQL q...
CVE-2025-58337 Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server
An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized...
CVE-2025-58337 Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode for doris-mcp-server MCP Server
An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized...
PT-2025-45102
Name of the Vulnerable Software and Affected Versions Doris MCP Server versions prior to 0.6.0 Description An attacker with a valid read-only account can bypass the Doris MCP Server’s read-only mode due to improper access control. This allows modifications that should have been prevented by...
PT-2025-45743
An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized...
CVE-2025-58337: Improper Access Control
An attacker with a valid read-only account can bypass Doris MCP Server’s read-only mode due to improper access control, allowing modifications that should have been prevented by read-only restrictions. Impact: Bypasses read-only mode; attackers with read-only access may perform unauthorized...
CVE-2023-7313
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting XSS via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2023-7313
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting XSS via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2023-7313
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting XSS via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...
CVE-2023-7313 Nagios XI < 5.11.3 XSS via Bulk Modifications
Nagios XI versions prior to 5.11.3 are vulnerable to cross-site scripting XSS via the Bulk Modifications tool. Insufficient validation or escaping of user-supplied input may allow an attacker to inject and execute arbitrary script in the context of a victim's browser...