MAL-2025-26859 Malicious code in mubiz-ws-cli (npm)

The package mubiz-ws-cli was found to contain malicious code...

MAL-2025-26860 Malicious code in mubiz-ws-client (npm)

The package mubiz-ws-client was found to contain malicious code...

MAL-2025-31857 Malicious code in react-tinderable-ws (npm)

The package react-tinderable-ws was found to contain malicious code...

Malicious code in gravitlauncher-ws-api (npm)

The package gravitlauncher-ws-api was found to contain malicious code...

Malicious code in mubiz-ws-client (npm)

The package mubiz-ws-client was found to contain malicious code...

Malicious code in twilio-gladia-ws (npm)

The package twilio-gladia-ws was found to contain malicious code...

Malicious code in mubiz-ws-cli (npm)

The package mubiz-ws-cli was found to contain malicious code...

Malicious code in ws-ui-tool (npm)

The package ws-ui-tool was found to contain malicious code...

MAL-2025-37374 Malicious code in twilio-gladia-ws (npm)

The package twilio-gladia-ws was found to contain malicious code...

MAL-2025-21899 Malicious code in gravitlauncher-ws-api (npm)

The package gravitlauncher-ws-api was found to contain malicious code...

MAL-2025-39497 Malicious code in ws-ui-tool (npm)

The package ws-ui-tool was found to contain malicious code...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in ws-3.3.3.tgz

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of ws-3.3.3.tgz Vulnerability Details CVEID:CVE-2024-37890 DESCRIPTION: ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be...

Security Bulletin: IBM Maximo Application Suite - Manage Component uses ws-7.5.9.tgz which is vulnerable to CVE-2024-37890

Summary Security Bulletin: IBM Maximo Application Suite - Manage Component uses ws-7.5.9.tgz which is vulnerable to CVE-2024-37890. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-37890 DESCRIPTION: ws is an open source WebSocke...

CVE-2024-51980

An unauthenticated attacker may perform a limited server side request forgery SSRF, forcing the target device to open a TCP connection to an arbitrary port number on an arbitrary IP address. This SSRF leverages the WS-Addressing ReplyTo element in a Web service HTTP TCP port 80 SOAP request. The...

CVE-2024-51983

An unauthenticated attacker who can connect to the Web Services feature HTTP TCP port 80 can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the...

CVE-2024-51983

An unauthenticated attacker who can connect to the Web Services feature HTTP TCP port 80 can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the...

CVE-2024-51981

An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...

CVE-2024-51983

CVE-2024-51983 is an unauthenticated DoS affecting multiple Brother/Brother-related devices (printer/ multifunction). The issue arises from improper validation of input in WS-Scan over Web Services (port 80); sending a WS-Scan SOAP request with an unexpected JobToken value crashes the device and ...

CVE-2024-51983 Unauthenticated Denial of Service (DoS) via malformed WS-Scan request affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, Toshiba Tec, and Konica Minolta, Inc.

An unauthenticated attacker who can connect to the Web Services feature HTTP TCP port 80 can issue a WS-Scan SOAP request containing an unexpected JobToken value which will crash the target device. The device will reboot, after which the attacker can reissue the command to repeatedly crash the...

CVE-2024-51981 Unauthenticated Server Side Request Forgery (SSRF) via WS-Eventing affecting multiple models from Brother Industries, Ltd, FUJIFILM Business Innovation, Ricoh, and Toshiba Tec, and Konica Minolta, Inc.

An unauthenticated attacker may perform a blind server side request forgery SSRF, due to a CLRF injection issue that can be leveraged to perform HTTP request smuggling. This SSRF leverages the WS-Addressing feature used during a WS-Eventing subscription SOAP operation. The attacker can control al...