ws Denial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ws - Denial of Service', 'Description' = %q This module exploits a Denial of Service vulnerability in npm module "ws". By sending a specially...

marked npm module heading ReDenial of Service

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'marked npm module "heading" ReDoS', 'Description' = %q This module exploits a Regular Expression Denial of Service vulnerability in the npm modul...

Malicious code in u-workflow.module.common.creative-size (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in full-watch-tu-jhoothi-main-makkar-on-fullmovies-online-streaming-at-homees14 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in get-current-env (npm)

--- -= Per source details. Do not edit below this line.=-...

Crypto Hardware Wallet Ledger's Supply Chain Breach Results in $600,000 Theft

Crypto hardware wallet maker Ledger published a new version of its "@ledgerhq/connect-kit" npm module after unidentified threat actors pushed malicious code that led to the theft of more than $600,000 in virtual assets. The compromise was the result of a former employee falling victim to a phishi...

git-url-parse 安全漏洞

npm git-url-parse is an npm module from npm that is used to parse the URL addresses of Git repositories. A security vulnerability exists in git-url-parse crate 0.4.4 and earlier, which stems from a Regular Expression Denial of Service ReDos vulnerability...

MAL-2023-742 Malicious code in recurrence-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 970492e695237c754d7801c30cdab26ae4402dd14fe49a15fbe5a009641021e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to Node.js npm module information disclosure (CVE-2022-29244)

Summary Potential Node.js npm module information disclosure vulnerability CVE-2022-29244 has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-29244 DESCRIPTION: Node.js npm module cou...

Threat Actors Adopt Havoc Framework for Post-Exploitation in Targeted Attacks

An open source command-and-control C2 framework known as Havoc is being adopted by threat actors as an alternative to other well-known legitimate toolkits like Cobalt Strike, Sliver, and Brute Ratel. Cybersecurity firm Zscaler said it observed a new campaign in the beginning of January 2023...

Typosquatting: Legit Abquery Package Duped with Malicious Aabquerys

By Deeba Ahmed Aabquerys use the typosquatting technique to encourage downloading malicious components, as it has been cleverly named to make it sound like the legitimate NPM module Abquery. This is a post from HackRead.com Read the original post: Typosquatting: Legit Abquery Package Duped with...

Security Bulletin: IBM App Connect Enterprise Certified Container may be vulnerable to loss of confidentiality due to CVE-2022-29244

Summary Node.js is used by all IBM App Connect Enterprise Certified Container operands. IBM App Connect Enterprise Certified Container operands may be vulnerable to loss of confidentiality. This bulletin provides patch information to address the reported vulnerability CVE-2022-29244 in Node.js...

Malicious code in 4ff-lib-foundation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c16dbacccef21f57da31243c5487f2df6e725cba9d9e291fec15951e7d6fa15f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

NodeJS System Information Library Command Injection (CVE-2021-21315)

Binary data nodejscve-2021-21315.nbin...

MAL-2022-4692 Malicious code in moodules (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4aee60ec70b63c1e0e1054d2f57957ce43110f6a33c58c2d4337296560a5d661 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

deep-defaults vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'deep-defaults' versions 1.0.0 through 1.0.5 allows attacker to cause a denial of service and may lead to remote code execution. Details The NPM module deep-defaults can be abused by Prototype Pollution vulnerability since the function deepDefaults do...

Changeset vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows attackers to cause a denial of service and may lead to remote code execution. Details The npm module 'changeset' can be abused by Prototype Pollution vulnerability since the function 'apply' does not che...

GHSA-2GQW-Q9R9-7F79 Changeset vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'changeset' versions 0.0.1 through 0.2.5 allows attackers to cause a denial of service and may lead to remote code execution. Details The npm module 'changeset' can be abused by Prototype Pollution vulnerability since the function 'apply' does not che...

GHSA-Q4XC-7CW8-CGFJ dset vulnerable to prototype pollution

Overview Prototype pollution vulnerability in 'dset' versions 1.0.0 through 2.0.1 allows attacker to cause a denial of service and may lead to remote code execution. Details The NPM module 'dset' can be abused by Prototype Pollution vulnerability since the function ‘export ' did not check for the...

Prototype pollution vulnerability in 'deep-set'

The NPM module 'deep-set' can be abused by Prototype Pollution vulnerability since the function deepSet does not check for the type of object before assigning value to the property. Due to this flaw an attacker could create a non-existent property or able to manipulate the property which leads to...