123 matches found
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the POST /api/n9e/datasource/list route, which lacks proper authorization checks. An attacker can obtain sensitive credentials, such as database passwords, HTTP bearer tokens, and mTLS client keys, by sending...
CVE-2026-58167
Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...
CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users
Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...
CVE-2026-58167
Nightingale (n9e) prior to 9.0.0-beta.2 exposes full datasource configurations (plaintext DB passwords, HTTP Bearer tokens, HTTP Basic passwords, and mTLS keys) via POST /api/n9e/datasource/list to any authenticated low-privilege user. The route lacks an admin gate and the DatasourceFilter does n...
CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users
Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...
CVE-2026-58167 Nightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users
Nightingale n9e before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege Standard role user through POST /api/n9e/datasource/list. The route is...
Malicious code in annual_nightingale_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f38759cab2230b3d7234206e9e3e2528fc1a566e7a09bb58309bf52e9b0dc5d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-102465
Malicious code in rivalnightingalez3n npm...
EUVD-2025-101606
Malicious code in torynightingalez3n npm...
EUVD-2025-99257
Malicious code in equivalentnightingalez3n npm...
EUVD-2025-98456
Malicious code in gorgeousnightingalez3n npm...
Malicious code in okay_nightingale_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81efedfbe822520db1c665334805d3d588e6978cc7f7c5cb06fe0dc6570b871f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-105919
Malicious code in devotednightingalez3n npm...
Malicious code in devoted_nightingale_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 34bd1457b9198fd9534531af47295178875622f2057395fd5fe6f3c1d30f051d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-89455
Malicious code in preliminarynightingalez3n npm...
EUVD-2025-89420
Malicious code in prominentnightingalez3n npm...
EUVD-2025-74497
Malicious code in legitimatenightingaleivory-43 npm...
EUVD-2025-74823
Malicious code in closenightingalesilver-47 npm...
EUVD-2025-74615
Malicious code in genuinenightingalerose-2 npm...
Malicious code in close_nightingale_silver-47 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 98357f0516f099e15e38f794c4f16c8aeecd72fcd5bf66cf420ea306f207436c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...