Malicious code in plain-function (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2e38d4006afc6d5a3ce531ced341af81b57134a68230e68e52122825f587260e The OpenSSF Package Analysis project identified 'plain-function' @ 20.1.1 npm as malicious. It is considered malicious because: - The package...

CVE-2023-21035

In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User...

UBUNTU-CVE-2023-21035

In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2023-21035

In multiple functions of BackupHelper.java, there is a possible way for an app to get permissions previously granted to another app with the same package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User...

Malicious Package

Overview @sectest456/toxic-pkg-dont-use is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Large-scale Cyber Attack Hijacks East Asian Websites for Adult Content Redirects

A widespread malicious cyber operation has hijacked thousands of websites aimed at East Asian audiences to redirect visitors to adult-themed content since early September 2022. The ongoing campaign entails injecting malicious JavaScript code to the hacked websites, often connecting to the target...

Debian: Security Advisory (DLA-1153-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious Package

Overview karma-jasmine-i-request is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview tempomati-omega-5-emcuf5 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview tempomati-omega-5-emcuf2 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview mk1 is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was installed...

Malicious Package

Overview @skinternal/my-test-package is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

PUB-A-236687884

In InstallStart of InstallStart.java, there is a possible way to change the installer package name due to an improper input validation. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation...

Malicious Package

Overview @b2bgeo/frontend-server-api-types is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable...

Malicious Package

Overview @blk/idm-okta-sdk-js is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious code in malicious-package-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adfb94ffd01d87848b7f1bf2ae04932224574efbda30f7ae3ecd5520c4c57d95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-578 Malicious code in malicious-package-name (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware adfb94ffd01d87848b7f1bf2ae04932224574efbda30f7ae3ecd5520c4c57d95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-20525

In enforceVisualVoicemailPackage of PhoneInterfaceManager.java, there is a possible leak of visual voicemail package name due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2022-20525

CVE-2022-20525 affects Android 13 and points to a permissions bypass in enforceVisualVoicemailPackage inside PhoneInterfaceManager.java, causing a leak of the visual voicemail package name. The impact is local elevation of privilege with no extra execution privileges and no user interaction requi...

PT-2022-14739 · Google · Android

Name of the Vulnerable Software and Affected Versions: Android versions Android-13 Description: The issue is related to a permissions bypass in the enforceVisualVoicemailPackage function of PhoneInterfaceManager.java, which could lead to a leak of the visual voicemail package name. This leak may...