GitLens Git Local Configuration Exec

GitKraken GitLens before v.14.0.0 allows an untrusted workspace to execute git commands. A repo may include its own .git folder including a malicious config file to execute arbitrary code. Tested against VSCode 1.87.2 with GitLens 13.6.0 on Ubuntu 22.04 and Windows 10 Module Options msf use...

Malicious code in vscode-mlir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c610eb26b75afffa49527255692e967a24bbe7fd61242d8c2f45420c72d9b589 The OpenSSF Package Analysis project identified 'vscode-mlir' @ 2.0.1 npm as malicious. It is considered malicious because: - The package execut...

MAL-2024-146 Malicious code in vscode-mlir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c610eb26b75afffa49527255692e967a24bbe7fd61242d8c2f45420c72d9b589 The OpenSSF Package Analysis project identified 'vscode-mlir' @ 2.0.1 npm as malicious. It is considered malicious because: - The package execut...

CVE-2023-46248

Cody is an artificial intelligence AI coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file .vscode/cody.json and...

Remote code execution

Cody is an artificial intelligence AI coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file .vscode/cody.json and...

CVE-2023-46248

CVE-2023-46248 affects the Cody AI VSCode extension (versions 0.10.0–0.14.0). An attacker controlling a malicious repository can modify the Cody configuration file ".vscode/cody.json" and overwrite Cody commands. If a user with the extension installed opens that repository and executes a Cody com...

CVE-2023-46248 Overwrite of builtin Cody commands facilitates RCE

Cody is an artificial intelligence AI coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file .vscode/cody.json and...

CVE-2023-46248 Overwrite of builtin Cody commands facilitates RCE

Cody is an artificial intelligence AI coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file .vscode/cody.json and...

CVE-2023-46248 Overwrite of builtin Cody commands facilitates RCE

Cody is an artificial intelligence AI coding assistant. The Cody AI VSCode extension versions 0.10.0 through 0.14.0 are vulnerable to Remote Code Execution under certain conditions. An attacker in control of a malicious repository could modify the Cody configuration file .vscode/cody.json and...

Flashloan/Sandwich Attacks on UpdateFunding()

Lines of code Vulnerability details Impact The attacker can launch a sandwich/flashloan attack on the updateFunding function to gain most of the reward. Proof of Concept 1. The attacker observed that some reward is going to be distributed via updateFunding function. 2. The attacker borrowed...

Wherever possible, _safeMint() should be used rather than _mint()

Lines of code Vulnerability details Impact mint is not recommended in favour of safeMint, which guarantees that the recipient is either an EOA. Proof of Concept, , Tools Used Vscode use safeMint instead of mint. Assessed type Upgradable --- The text was updated successfully, but these errors were...

FreeBSD : vscode -- VS Code Information Disclosure Vulnerability (f0250129-fdb8-41ed-aa9e-661ff5026845)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the f0250129-fdb8-41ed-aa9e-661ff5026845 advisory. - Visual Studio Code Spoofing Vulnerability CVE-2023-33144 Note that Nessus has not tested for this iss...

There can be a maximum of 11 proposals

Lines of code Vulnerability details Impact Overflow Proof of Concept The proposeExtraordinary function restricts that the result of the getMinimumThresholdPercentage function must be less than or equal to 1018. The maximum length of the fundedExtraordinaryProposals array is 10, but there is no...

Visual Studio Code Server Files Detected

Visual Studio Code is a popular source-code editor provided by Microsoft, with extensions offering a variety of extra functionality including remote workspace access via ssh. Use of this remote workflow creates a hidden directory named .vscode-server on the remote server which may be exposed with...

Integer Overflow in Endian Library

Lines of code Vulnerability details Impact An integer overflow can lead to unexpected behavior in a smart contract, potentially causing financial loss or disruption of the contract's intended functionality. Proof of Concept If the input value passed to the function exceeds 64 bits, an integer...

Malicious Package

Overview vscode-github-actions is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious code in vscode-github-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9186f60970b4228055c97ae3bbbf2c4691411f82c44db8033fc56d68cae50fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-945 Malicious code in vscode-github-actions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9186f60970b4228055c97ae3bbbf2c4691411f82c44db8033fc56d68cae50fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-946 Malicious code in vscode-smoketest-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 137816df474676baa29f1ab9e87b99bfda74ca256ea10e09f9a7971bc580302f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vscode-smoketest-express (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 137816df474676baa29f1ab9e87b99bfda74ca256ea10e09f9a7971bc580302f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...