39 matches found
CVE-2022-41040
CVE-2022-41040 Microsoft Exchange уязвим к подделке серверных запросов SSRF Полезная нагрузка : /autodiscover/autodiscover.json?@URL/&Email=autodiscover/autodiscover.json%3f@URL /autodiscover/autodiscover.json?@%d.v1.COLLABHERE/&Email=autodiscover/autodiscover.json%3f@%d.v1.COLLABHERE...
CVE-2026-10032 Arbitrary JavaScript Execution via openUrl in @a2ui/web_core
The openUrl function in @a2ui/webcore passes an agent-controlled URL directly to window.open without validating the URI scheme. A malicious agent can supply a javascript: URI as the url argument of a Button component's functionCall action. When the user clicks the rendered button, arbitrary...
PT-2026-67730
Name of the Vulnerable Software and Affected Versions @a2ui/web core affected versions not specified Description The openUrl function fails to validate the URI scheme before passing a URL to window.open. A malicious agent can provide a javascript: URI via the url argument of a Button component's...
MAL-2026-7050 Malicious code in @bmg-web/bmg-core (npm)
--- -= Per source details. Do not edit below this line.=-...
EUVD-2025-208903
The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack...
CVE-2025-67260
The Terrapack software, from ASTER TEC / ASTER S.p.A., with the indicated components and versions has a file upload vulnerability that may allow attackers to execute arbitrary code. Vulnerable components include Terrapack TkWebCoreNG:: 1.0.20200914, Terrapack TKServerCGI 2.5.4.150, and Terrapack...
Terrapack Arbitrary File Upload
Terrapack software suffers from an arbitrary file upload vulnerability that may allow attackers to execute arbitrary code. Affected software includes Terrapack TkWebCoreNG version 1.0.20200914, TKServerCGI version 2.5.4.150, and TpkWebGIS - Client version 1.0.0...
Malicious Package
Overview @liquid-web/core-services is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
Malicious code in @liquid-web/core-services (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f9afbcbd82f8b0c7374b5e9edb81329aa506296ef39a5a63d70d59af7591e74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @moonpig/web-core-app (npm)
The package @moonpig/web-core-app was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...
MAL-2025-9108 Malicious code in @moonpig/web-core-utils (npm)
The package @moonpig/web-core-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...
MAL-2025-38504 Malicious code in visto-web-core (npm)
The package visto-web-core was found to contain malicious code...
MAL-2025-17859 Malicious code in cwt-booking-web-core (npm)
The package cwt-booking-web-core was found to contain malicious code...
Malicious code in @moonpig/web-core-utils (npm)
The package @moonpig/web-core-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...
Malicious code in ee-web-core (npm)
The package ee-web-core was found to contain malicious code...
Malicious code in visto-web-core (npm)
The package visto-web-core was found to contain malicious code...
MAL-2025-9107 Malicious code in @moonpig/web-core-app (npm)
The package @moonpig/web-core-app was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...
MAL-2025-19229 Malicious code in ee-web-core (npm)
The package ee-web-core was found to contain malicious code...