142 matches found
CVE-2020-7597
codecov-node npm module before 3.6.5 allows remote attackers to execute arbitrary commands.The value provided as part of the gcov-root argument is executed by the exec function within lib/codecov.js. This vulnerability exists due to an incomplete fix of CVE-2020-7596...
CVE-2020-7596
Codecov npm module before 3.6.2 allows remote attackers to execute arbitrary commands via the "gcov-args" argument...
CVE-2019-5480
A path traversal vulnerability in = v0.9.7 of statichttpserver npm module allows attackers to list files in arbitrary folders...
CVE-2019-10783
All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function to parse user input...
Malicious code in module-grab (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb37f88f9f6a37fa239ee1d591acdd1ee642b1d6447cba12accde00c474a94bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
ws Denial of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ws - Denial of Service', 'Description' = %q This module exploits a Denial of Service vulnerability in npm module "ws". By sending a specially...
ua-parser-js npm module ReDenial of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ua-parser-js npm module ReDoS', 'Description' = %q This module exploits a Regular Expression Denial of Service vulnerability in the npm module...
marked npm module heading ReDenial of Service
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'marked npm module "heading" ReDoS', 'Description' = %q This module exploits a Regular Expression Denial of Service vulnerability in the npm modul...
Malicious code in u-workflow.module.common.creative-size (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in full-watch-tu-jhoothi-main-makkar-on-fullmovies-online-streaming-at-homees14 (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in get-current-env (npm)
--- -= Per source details. Do not edit below this line.=-...
Crypto Hardware Wallet Ledger's Supply Chain Breach Results in $600,000 Theft
Crypto hardware wallet maker Ledger published a new version of its "@ledgerhq/connect-kit" npm module after unidentified threat actors pushed malicious code that led to the theft of more than $600,000 in virtual assets. The compromise was the result of a former employee falling victim to a phishi...
git-url-parse 安全漏洞
npm git-url-parse is an npm module from npm that is used to parse the URL addresses of Git repositories. A security vulnerability exists in git-url-parse crate 0.4.4 and earlier, which stems from a Regular Expression Denial of Service ReDos vulnerability...
MAL-2023-742 Malicious code in recurrence-formatter (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 970492e695237c754d7801c30cdab26ae4402dd14fe49a15fbe5a009641021e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js npm module information disclosure (CVE-2022-29244)
Summary Potential Node.js npm module information disclosure vulnerability CVE-2022-29244 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-29244 DESCRIPTION: Node.js npm module cou...
Threat Actors Adopt Havoc Framework for Post-Exploitation in Targeted Attacks
An open source command-and-control C2 framework known as Havoc is being adopted by threat actors as an alternative to other well-known legitimate toolkits like Cobalt Strike, Sliver, and Brute Ratel. Cybersecurity firm Zscaler said it observed a new campaign in the beginning of January 2023...
Typosquatting: Legit Abquery Package Duped with Malicious Aabquerys
By Deeba Ahmed Aabquerys use the typosquatting technique to encourage downloading malicious components, as it has been cleverly named to make it sound like the legitimate NPM module Abquery. This is a post from HackRead.com Read the original post: Typosquatting: Legit Abquery Package Duped with...
Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to loss of confidentiality due to CVE-2022-29244
Summary Node.js is used by all IBM App Connect Enterprise Certified Container operands. IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability CVE-2022-29244 in Node.js...
Malicious code in 4ff-lib-foundation (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c16dbacccef21f57da31243c5487f2df6e725cba9d9e291fec15951e7d6fa15f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
