950658 matches found
MAL-2026-16333 Malicious code in homestack-cheer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142 The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build dist/my-lib.umd.js prese...
Malicious code in homestack-cheer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f475cd8b8a3e1dd4563ca0b20d85fde83576ed78c27eb91ca1cd77fbebe0d142 The package is published as homestack-cheer with description 'JS lib support cheerleading', but the README and the UMD build dist/my-lib.umd.js prese...
CVE-2019-5418
CVE-2019-5418 1. 脆弱性の説明 Ruby on RailsはWebアプリケーションフレームワークであり、比較的新しいフレームワークで、Ruby言語上に構築されています。この脆弱性は主に、Ruby on Railsが指定されたパラメータのrender fileを使用してアプリケーション外のビューをレンダリングすることに起因します。特定のコントローラにアクセスするリクエストパケットを変更し、「…/…/…/…/」を使用してパストラバーサルを達成し、次に「」を使用してテンプレートクエリパスを閉じることにより、対象のファイルが外部テンプレートとして解析されるようにします。 3...
MAL-2026-16318 Malicious code in @asenfotech/unplugin-element-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under...
Malicious code in @asenfotech/unplugin-element-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 458bff9dc8d1f808d642b767ca08ca89253919bbf0d7fd2890b95f3b9c156926 Package presents itself as an Element Plus resolver for Vue tooling: index.js is a 25-line ElementPlusResolver stub. The bulk of the tarball under...
Malicious code in element-plus-vite-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b7636f89146191d649c38819e975fc41167a53276c66aea0b43789eb8d39338 On load main index.js → bin/cli.js, the package invokes tooling-bootstrap.cjs which walks up from the consumer project's cwd/INITCWD looking for one ...
MAL-2026-16331 Malicious code in element-plus-vite-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b7636f89146191d649c38819e975fc41167a53276c66aea0b43789eb8d39338 On load main index.js → bin/cli.js, the package invokes tooling-bootstrap.cjs which walks up from the consumer project's cwd/INITCWD looking for one ...
CVE-2026-94138
A command injection vulnerability exists in Chengdu Feiyuxing Technology Feiyu Star Router (version B-MB5E202-210322-r11656). The flaw resides in the /send_order.cgi script (parameter=del_expmac), where manipulation of the mac argument allows command execution. The attack can be launched remotely...
CVE-2026-94138 Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection
A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...
CVE-2026-94138 Chengdu Feiyuxing Technology Feiyu Star Router send_order.cgi command injection
A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...
EUVD-2026-83831
A security flaw has been discovered in Chengdu Feiyuxing Technology Feiyu Star Router B-MB5E202-210322-r11656. This impacts an unknown function of the file /sendorder.cgi?parameter=delexpmac. The manipulation of the argument mac results in command injection. The attack may be launched remotely. T...
MAL-2026-16344 Malicious code in sorrawit-dev-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233 package.json declares a postinstall lifecycle script that runs automatically on npm install. The script reads /tmp/flag.txt from the installer's...
Malicious code in sorrawit-dev-helper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c64040dcfbbdb6ce434caf3cd5bd2baa518cc00970281a69f5309d57a4621233 package.json declares a postinstall lifecycle script that runs automatically on npm install. The script reads /tmp/flag.txt from the installer's...
Malicious code in catwrestlinghuman (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4045339387526c5db90832687d1691c2caddba3b9cb05006022704bf094653 package.json declares a postinstall hook node index.js. index.js is a 111KB blob composed exclusively of the JSFuck character set !+, which decodes a...
MAL-2026-16328 Malicious code in catwrestlinghuman (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c4045339387526c5db90832687d1691c2caddba3b9cb05006022704bf094653 package.json declares a postinstall hook node index.js. index.js is a 111KB blob composed exclusively of the JSFuck character set !+, which decodes a...
Malicious code in siriusbeyond (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce19ca17a48cf79dd094940533d1bff88413d44c945948d0041da15a5b61779 package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so npm install siriusbeyond executes it automatically...
MAL-2026-16343 Malicious code in siriusbeyond (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ce19ca17a48cf79dd094940533d1bff88413d44c945948d0041da15a5b61779 package.json wires callback.js to both the preinstall and postinstall lifecycle hooks, so npm install siriusbeyond executes it automatically...
Malicious code in @dbbhk/ui-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07 @dbbhk/[email protected] declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs...
MAL-2026-16319 Malicious code in @dbbhk/ui-components (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 478839dda68d2c5eefa1a55557602d4b12396c988211b28d785af531d0b19d07 @dbbhk/[email protected] declares both preinstall and postinstall hooks in package.json that execute node callback.js, so the payload runs...
cve-2021-22005-exp
cve-2021-22005-exp 0x01 脆弱性の概要 2021年9月21日、VMwareはセキュリティアドバイザリを公開し、vCenter Serverにおける19件のセキュリティ脆弱性を開示しました。これらの脆弱性のCVSSv3スコアは4.3〜9.8の範囲です。 その中でも最も深刻な脆弱性は、vCenter Serverにおける任意ファイルアップロードの脆弱性（CVE-2021-22005）です。この脆弱性はvCenter Serverの分析サービスに存在し、そのCVSSv3スコアは9.8です。vCenter...