BIT-LIVEHELPERCHAT-2022-0266

Authorization Bypass Through User-Controlled Key in Packagist remdex/livehelperchat prior to 3.92v...

BIT-LIVEHELPERCHAT-2022-0374

Cross-site Scripting XSS - Stored in Packagist remdex/livehelperchat prior to 3.93v...

BIT-LIVEHELPERCHAT-2022-0375

Cross-site Scripting XSS - Stored in Packagist remdex/livehelperchat prior to 3.93v...

BIT-LIVEHELPERCHAT-2022-0394

Cross-site Scripting XSS - Stored in Packagist remdex/livehelperchat prior to 3.93v...

BIT-LIVEHELPERCHAT-2022-0395

Cross-site Scripting XSS - Stored in Packagist remdex/livehelperchat prior to 3.93v...

BIT-LIVEHELPERCHAT-2022-0502

Cross-site Scripting XSS - Stored in Packagist remdex/livehelperchat prior to 3.93v...

BIT-LIVEHELPERCHAT-2022-0612

Cross-site Scripting XSS - Stored in Packagist remdex/livehelperchat prior to 3.93v...

BIT-COMPOSER-2021-29472 Missing argument delimiter can lead to code execution via VCS repository URLs or source download URLs on systems with Mercurial in composer

Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to...

Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM : Composer vulnerability (USN-5220-1)

The remote Ubuntu 16.04 ESM / 18.04 ESM / 20.04 ESM host has a package installed that is affected by a vulnerability as referenced in the USN-5220-1 advisory. It was discovered that Composer did not properly sanitize URLs for Mercurial repositories in the root composer.json and package source...

Packagist Repository Hacked: Over a Dozen PHP Packages with 500 Million Installs Compromised

PHP software package repository Packagist revealed that an "attacker" gained access to four inactive accounts on the platform to hijack over a dozen packages with over 500 million installs to date. "The attacker forked each of the packages and replaced the package description in composer.json wit...

Packagist Repository Hacked: Over a Dozen PHP Packages with 500 Million Installs Compromised

PHP software package repository Packagist revealed that an "attacker" gained access to four inactive accounts on the platform to hijack over a dozen packages with over 500 million installs to date. "The attacker forked each of the packages and replaced the package description in composer.json wit...

SUSE CVE-2021-29472

Composer is a dependency manager for PHP. URLs for Mercurial repositories in the root composer.json and package source download URLs are not sanitized correctly. Specifically crafted URL values allow code to be executed in the HgDriver if hg/Mercurial is installed on the system. The impact to...

SUSE CVE-2022-24828

Composer is a dependency manager for the PHP programming language. Integrators using Composer code to call VcsDriver::getFileContent can have a code injection vulnerability if the user can control the $file or $identifier argument. This leads to a vulnerability on packagist.org for example where...

symfont/process typosquatting malware spoofs symfony/process

In September 2021, security researchers discovered a malicious Composer package called symfont/process, a typosquat targeting users of symfony/process. The malicious package has since been removed from Packagist...

GHSA-G3J5-MPP2-2FQM symfont/process typosquatting malware spoofs symfony/process

In September 2021, security researchers discovered a malicious Composer package called symfont/process, a typosquat targeting users of symfony/process. The malicious package has since been removed from Packagist...

Packagist Microweber Arbitrary File Upload (CVE-2022-0557)

An arbitrary file upload vulnerability exists in Packagist Microweber. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Bomber - Scans Software Bill Of Materials (SBOMs) For Security Vulnerabilities

bomber is an application that scans SBOMs for security vulnerabilities. Overview So you've asked a vendor for an Software Bill of Materials SBOM for one of their closed source products, and they provided one to you in a JSON file... now what? The first thing you're going to want to do is see if a...

Researchers Report Supply Chain Vulnerability in Packagist PHP Repository

Researchers have disclosed details about a now-patched high-severity security flaw in Packagist, a PHP software package repository, that could have been exploited to mount software supply chain attacks. "This vulnerability allows gaining control of Packagist," SonarSource researcher Thomas...

GHSA-5JGJ-H9WP-53FR Known vulnerable to code execution via SVG file in v1.3.1

An issue in the isSVG function of Known v1.3.1 allows attackers to execute arbitrary code via a crafted SVG file. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last version tagged on GitHub and in Packagist, and development related to the 1.3.x...

Known v1.3.1 Cross-site Scripting

A cross-site scripting XSS vulnerability in Known v1.3.1 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Your Name text field. The researcher report indicates that versions 1.3.1 and prior are vulnerable. Version 1.2.2 is the last...