Malicious code in ngx-ndbx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b85b4ba8a7146a1450ff0a1cc8b119bda90a838d67b93d8ad4f080551bfe002e The OpenSSF Package Analysis project identified 'ngx-ndbx' @ 18.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8722 Malicious code in ngx-xtra-schematics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39fcb0686c6bf17f5a78d7827eaf93bcc16a57fc2f587d232b316e076cedaa0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ngx-xtra-schematics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39fcb0686c6bf17f5a78d7827eaf93bcc16a57fc2f587d232b316e076cedaa0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-36057 · Git +1 · Ghostscript

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a heap-use-after-free error, which occurs when the program attempts to access memory that has already been freed. The crash state...

Malicious code in @intact-lab/ngx-iceberg-links (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 55d4c2e5564fb8d843d5672f7952d370ab93e26d7c031567fc4db522c21ce0b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-7926 Malicious code in @intact-lab/ngx-iceberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63ed3b552a74f73b31973f3f5a4a21e344617adcaef85804c109a61a1956facc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @intact-lab/ngx-iceberg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63ed3b552a74f73b31973f3f5a4a21e344617adcaef85804c109a61a1956facc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @sbb2b/ngx.sportsbook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ccf1238d371f61b48d44f2b32d79ce73e0d25a42508d9e535ce93580010016d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ngx-infinite-scroll-fixed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fc6e4f4f6c9bb18d908e27efa5494ad7f70f25140841c4ac2dc596288dcc560 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-623 Malicious code in ngx-infinite-scroll-fixed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fc6e4f4f6c9bb18d908e27efa5494ad7f70f25140841c4ac2dc596288dcc560 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.5), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=6.1.0) +84 more potentially affected by CVE-2022-22984 via snyk (>=1.1.1, <=1.954.0)

snyk NPM version =1.1.1, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =3.2.4, =1.6.0, =1.1.0, =1.0.1, =1.0.14 and more Source cves: CVE-2022-22984 Source advisory: OSV:GHSA-4X6G-3CMX-W76R...

PT-2022-5185

Name of the Vulnerable Software and Affected Versions NGINX Open Source versions 1.23.2 and 1.22.1 and earlier NGINX Open Source Subscription versions R2 P1 and R1 P1 and earlier NGINX Plus versions R27 P1 and R26 P1 and earlier Description The issue is related to a buffer-over-read vulnerability...

Malicious Package

Overview ngx-infinite-scroll-fixed is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

MAL-2022-7198 Malicious code in wm-ngx-graph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59d008558ea082e70d8eade3399fd8c963ded5a168c8ee63bdbb2d110173976c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wm-ngx-graph (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59d008558ea082e70d8eade3399fd8c963ded5a168c8ee63bdbb2d110173976c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview wm-ngx-graph is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious code in ngx-translate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1100a503faf33aad0489ce41d03404d9f250bc81751ec29be8109e87d9c6d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@eqproject/eqp-dashboard (>=2.0.3, <=2.5.2), @eqproject/eqp-datetimerangepicker (>=0.0.1, <=3.0.10) +7 more potentially affected by unknown CVE via ngx-translate (0.0.1-security)

ngx-translate NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on ngx-translate and may be impacted: - @eqproject/eqp-dashboard =2.0.3, =0.0.1, =2.0.10, =0.0.1, =18.0.0-beta.2 - kms-ngx-ui 16.12.30 - mat-table-ext 0.0.0 -...

MAL-2022-4849 Malicious code in ngx-translate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e1100a503faf33aad0489ce41d03404d9f250bc81751ec29be8109e87d9c6d6b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2022-1650377152 Fix CVE(s): CVE-2020-11724

SECURITY UPDATE: HTTP request smuggling in Lua module - debian/modules/nginx-lua: Fix parsing HTTP headers in the ngx.location.capture API porting an upstream patch 9ab38e8ee35fc08a57636b1b6190dca70b0076fa from https://github.com/openresty/lua-nginx-module - CVE-2020-11724...