78 matches found
Plastic SCM 8087 name-only ACL trigger RCE
NameWorkingMode + default ACL: cm trigger create with attacker Path → Process.Start. Requires local cm client; declares plasticuser no password. """Plastic SCM / Unity VCS name-only auth trigger RCE port 8087, cm client.""" from future import annotations import os import subprocess from kittysplo...
CVE-2026-108711
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...
CVE-2026-108711
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...
CVE-2026-108711 Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...
EUVD-2026-96985
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...
CVE-2026-108711 Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...
CVE-2026-108711
Plastic Labs Honcho versions through 3.3.0 are vulnerable to an incorrect authorization flaw (CWE-863) via the POST /v3/workspaces endpoint. The root cause is that the get_or_create_workspace function only validates the workspace claim, allowing API key holders with peer- or session-scoped access...
CVE-2026-108711 Plastic Labs Honcho through 3.3.0 Incorrect Authorization via POST /v3/workspaces
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...
CVE-2026-108711: Incorrect Authorization
Plastic Labs Honcho through 3.3.0 contains an incorrect authorization vulnerability that allows peer- or session-scoped API key holders to read workspace data because getorcreateworkspace checks only the workspace claim. Attackers can submit their parent workspace name to the POST /v3/workspaces...
PT-2026-110114
Name of the Vulnerable Software and Affected Versions Plastic Labs Honcho versions prior to 3.3.1 Description An incorrect authorization issue exists where holders of peer- or session-scoped API keys can access workspace data. This occurs because the get or create workspace function only verifies...
Plastic Labs’ CEO authorization issue vulnerability
Plastic Labs versions 3.3.0 and earlier have an authorization issue. This vulnerability stems from improper authorization handling; the getorcreateworkspace function only checks the workspace declaration. As a result, holders of API keys with per-app or session scope can access workspace data...
Unity Plastic SCM Login Panel - Detect
Unity Plastic SCM login panel was detected. !/usr/bin/env python3 -- coding: utf-8 -- """Unity Plastic SCM login panel was detected.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info = 'name': 'Unity Plastic SCM Login Panel -...
EUVD-2025-95782
Malicious code in plasticdragonz3n npm...
EUVD-2025-89478
Malicious code in plasticwallabyz3n npm...
EUVD-2025-78608
Malicious code in plasticchipmunkz3n npm...
EUVD-2025-78607
Malicious code in plasticgibbonz3n npm...
EUVD-2025-80932
Malicious code in plasticgullreplicateautomation npm...
EUVD-2025-71420
Malicious code in plasticlampreyz3n npm...
Malicious code in plastic_rattlesnake_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5241d50def55153f658e33ebade7be60cf13fc5a4714b255594259ffa645cbcf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...