Malicious Package

Overview @usemosaik/template-react-js is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious...

Malicious Package

Overview databricks-webapp-navigation-homepage is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all...

Malicious Package

Overview py-devoli-common is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...

Uncontrolled Recursion

Overview github.com/google/go-attestation/attest is a Go-Attestation abstracts remote attestation operations across a variety of platforms and TPMs, enabling remote validation of machine identity and state. This project attempts to provide high-level primitives for both client and server logic...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict through normalizeAddress in lib/mime-node/index.js. An attacker can cause mail to be delivered to an attacker-controlled domain by...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict through normalizeAddress in lib/mime-node/index.js. An attacker can cause mail to be delivered to an attacker-controlled...

Inefficient Algorithmic Complexity

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the addressparser function in lib/addressparser/index.js. An attacker can block the Node.js event loop by supplying a...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the addressparser function in lib/addressparser/index.js. An attacker can block the Node.js event loo...

Interpretation Conflict

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via RFC 5322 comment mis-parsing in lib/addressparser/index.js. An attacker can make mail be delivered to an attacker-controlled domain ...

Interpretation Conflict

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Interpretation Conflict via RFC 5322 comment mis-parsing in lib/addressparser/index.js. An attacker can make mail be delivered to an...

Improper Neutralization of Special Elements in Data Query Logic

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via improper validation of database and collection names. An attacker can access or manipulate unintended databases or collections by supplying input containing prohibited...

Heap-based Buffer Overflow

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Heap-based Buffer Overflow due to the Sharp image optimization. An attacker can execute code on the server by supplying a malicious...

Command Injection

Overview composer/composer is a Dependency Manager for PHP. Composer helps you declare, manage and install dependencies of PHP projects. It ensures you have the right stack everywhere. Affected versions of this package are vulnerable to Command Injection via the handling of Perforce source...

Heap-based Buffer Overflow

Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the VipsForeignLoadHeif process. An attacker can execute arbitrary code by...

Heap-based Buffer Overflow

Overview org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the VipsForeignLoadHeif process. An attacker can execute arbitra...

Regular Expression Denial of Service (ReDoS)

Overview @tiptap/core is a headless rich text editor Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the Pandoc-style parseAttributes helper in packages/core/src/utilities/markdown/attributeUtils.ts and the shortcode attribute parser in...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception through the HTTP/2 header processing path in internal/transport/http2server.go and internal/xds/server/routing.go. An attacker can crash the server by sending a gRPC request that omits both the :authority and Host...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception through the HTTP/2 header processing path in internal/transport/http2server.go and internal/xds/server/routing.go. An attacker can crash the server by sending a gRPC request that omits both the :authority and Host...

Uncaught Exception

Overview Affected versions of this package are vulnerable to Uncaught Exception through the HTTP/2 header processing path in internal/transport/http2server.go and internal/xds/server/routing.go. An attacker can crash the server by sending a gRPC request that omits both the :authority and Host...

Server-side Request Forgery (SSRF)

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the resolveContent method in lib/mailer/mail-message.js. An attacker can read local files or trigger outbound URL fetches b...

Server-side Request Forgery (SSRF)

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the resolveContent method in lib/mailer/mail-message.js. An attacker can read local files or trigger outbou...

Out-of-Bounds

Overview Affected versions of this package are vulnerable to Out-of-Bounds in the nalsend function. An attacker can cause memory corruption by transmitting a specially crafted input file that results in a negative size parameter being passed to memcpy during RTP encoding of H.264/HEVC streams...

Untrusted Search Path

Overview Affected versions of this package are vulnerable to Untrusted Search Path through the macOS host detector command execution in HostDetector.cs. An attacker can execute arbitrary code in the application's security context by supplying a malicious ioreg binary earlier in PATH and triggerin...

CRLF Injection

Overview Affected versions of this package are vulnerable to CRLF Injection in AbstractAggregateConnection::write in src/Connection/AbstractAggregateConnection.php, which re-parses the already serialized pipeline buffer by splitting on \r\n and rebuilding chunks through Command::deserializeComman...

Data Amplification

Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to Data Amplification in the default transport's response decompression, which inflates each network read of up to 64 KiB completely into a single intermediate allocation before yielding any...

HTTP Request Smuggling

Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to HTTP Request Smuggling in Request.prepare, which applies a generated Content-Length header through setdefault whenever the body size is known, without checking whether the caller has already...

CRLF Injection

Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to CRLF Injection in the FileField.renderheaders method, which writes the per file contenttype value and any custom header names and values into the multipart part header block without rejecting...

Inefficient Algorithmic Complexity

Overview httpx2 is a The next generation HTTP client. Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity through the sse. An attacker can cause excessive CPU consumption by sending a long, unterminated line split across many small response chunks from a...

Cleartext Transmission of Sensitive Information

Overview httpcore2 is an A minimal low-level HTTP client. Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the synchronous and asynchronous SOCKS5 connection implementations, which decide whether to start TLS by testing for the https scheme...

External Control of File Name or Path

Overview Affected versions of this package are vulnerable to External Control of File Name or Path via the store process. An attacker can overwrite arbitrary existing files writable by the PHP process with partially controlled content by supplying a crafted export path, potentially leading to...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to improper removal of sensitive information before storage or transfer. An attacker can gain unauthorized access to confidential data by intercepting network...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer due to improper removal of sensitive information before storage or transfer. An attacker can gain unauthorized access to confidential data by intercepting network...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication through the AadOidcIdTokenDecoderFactory and AadB2cOidcIdTokenDecoderFactory OIDC ID token decoders in the Spring Cloud Azure OAuth2 login components. An attacker can elevate privileges and sign in as an...

Unsafe Dependency Resolution

Overview mlflow is a platform to streamline machine learning development, including tracking experiments, packaging code into reproducible runs, and sharing and deploying models. Affected versions of this package are vulnerable to Unsafe Dependency Resolution through the model artifact loading...

Inefficient Algorithmic Complexity

Overview io.netty:netty-handler is a library that provides an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which...

Origin Validation Error

Overview apache-airflow-providers-fab is a Provider package apache-airflow-providers-fab for Apache Airflow Affected versions of this package are vulnerable to Origin Validation Error due to missing issuer and audience validation in decodeandvalidateazurejwt in...

Insufficiently Protected Credentials

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the WORKLOADIDENTITY authenticator through AuthByWorkloadIdentity.prepare in src/snowflake/connector/auth/workloadidentity.py. An...

Server-side Request Forgery (SSRF)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the ExternalUrl validation process. An attacker can access internal services or cloud metadata endpoints by configuring webhook URLs with...

Incorrect Calculation

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Incorrect Calculation via the checkout request process. An attacker can manipulate the assets.requestscounter by repeatedly submitting duplicate checkout requests or calling...

Missing Authorization

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Missing Authorization via the GET /hardware/asset/barcode endpoint. An attacker can access barcodes and enumerate asset tags across tenants, including soft-deleted and...

Denial of Service (DoS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Denial of Service DoS via the note field in the POST /account/accept/acceptance endpoint. An attacker can exhaust server resources by submitting excessively large input,...

Command Injection

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Command Injection via the restore process. An attacker can execute arbitrary operating system commands as the web application's user by uploading a crafted backup archive an...

Cross-site Scripting (XSS)

Overview snipe/snipe-it is an asset management system built on Laravel. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Custom CSS field due to incomplete sanitization that reverses HTML encoding on certain characters. An attacker can execute malicious CSS...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to a race condition in the server when handling RSTSTREAM and GOAWAY frames. An attacker can cause the server to become unresponsive by sending specially crafted HTTP/2 requests...

HTTP Request Smuggling

Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the chunked request parsing of HttpParser, which accepts a lone LF, rather than CRLF, as the line terminator for chunk extensions, chunk dat...

Insertion of Sensitive Information into Log File

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can obtain authentication tokens, encryption keys, pre-signed URLs, and SAML assertions...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the tokensFromInput method of TreePointer, which parses JSON Pointer segments with repeated substring calls that copy the remaining string each iteration On^2 and accumulates the...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in JsonLoader.fromURL, which fetches any URL without validation, and to memory amplification through JacksonUtils.newMapper, which enables WRITEBIGDECIMALASPLAIN so a BigDecimal serializes via...

Malicious Package

Overview glia-functions-tools is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dbt-language-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...