MAL-2022-497 Malicious code in @passit/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 63edaf30d1342edaea9754ea5bff2122c582b88298d610da8efa3d3ffd9d5eb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Passit: URL is vulnerable to clickjacking https://app.passit.io/

URLs do not have X-FRAME-OPTIONS set to DENY or SAMEORIGIN, and they are vulnerable to clickjacking. Reproduce steps: 1. enter your credentials and click on stay logged into this device then login 2. Run under the browser's code and you will see that the listed links are vulnerable to clickjackin...

Passit: Insecure opening of external links in app.passit.io/list allows for reverse tabnabbing

Description https://app.passit.io/list renders external links under attacker control that open in a new tab such that the opened tab has access to the opening tab where the user was just browsing on app.passit.io via window.opener. This is likely due to the lack of specifying a rel="noopener"...

Passit: Missing HSTS (Strict Transport Security)

Added HSTS headers...

Passit: X-Content-Type-Options has not been set at app.passit.io

Hi The Http Header X-Content-Type-Options is missing. Impact Your website http://app.passit.io/ doesn't have a header settings for X-Content-Type Options which means it is vulnerable to MIME sniffing. The only defined value, 'nosniff', prevents Internet Explorer and Google Chrome from MIME-sniffi...

Passit: Session not changed after password reset

Hey, I've found a session management in app.passit.io, which can lead to session takeover! Issue: ============== When the password of an account is changed from a session, other sessions doesn't expire! Steps To Reproduce: ====================== 1 we need to use two different browsers ex:- 1...

Passit: app.passit.io is vulnerable against Brute Force password quessing attack

Summary: app.passit.io is vulnerable against Brute Force password quessing attack Description: Hello! I have found out that your login functionality is vulnerable against brute force attack. This is especially dangerous in your case because an attacker can get all of users passwords if they brute...

Passit: Authentication Required When password change

Description of the issue :- I have found that when changing password in passit account there is no Authentication process by asking current password or any other confirmation If a user leaves their computer or account is still active in insecure place,or if account is hijacked or if CSRF is...