XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

XML External Entity (XXE) Injection

Overview Affected versions of this package are vulnerable to XML External Entity XXE Injection in the DocumentBuilder process when parsing XML content from the ZTIMEINTERVALS column of a Merlin project SQLite file. An attacker can access arbitrary files by supplying a specially crafted XML payloa...

Malicious Package

Overview gitcredentialmanager is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid using all malicious...

Malicious Package

Overview fastlane-plugin-runtestsfirebasetestlab is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid...

Malicious Package

Overview @vite-mcp/vite-type is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

Malicious Package

Overview @vite-ts/vite-ui is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

Malicious Package

Overview @vitets/vite-ts is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

Malicious Package

Overview @uw010010/vite-tree is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

Malicious Package

Overview @vite-tab/tab is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal credentia...

Malicious Package

Overview @vite-pro/vite-ui is a malicious package. This package contains malicious code and is part of a campaign targeting developers using Vite. When imported into an application, it downloads and executes a remote access trojan RAT, enabling attackers to execute arbitrary commands, steal...

Malicious Package

Overview Dendreo is a malicious package. This package contains malicious code and is part of the SleeperGem supply chain campaign targeting RubyGems users. Malicious functionality was introduced in the specified affected versions of the package. Remediation Avoid using all malicious instances of...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CheckSSRF function in webshared.go of the webfetch component. An attacker can access internal network resources and potentially exfiltrate sensitive information or manipulate internal services by...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the CheckSSRF function in webshared.go of the webfetch component. An attacker can access internal network resources and potentially exfiltrate sensitive information or manipulate internal services by...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the ToolsInvokeHandler.ServeHTTP process. An attacker can gain unauthorized access to the Invoke Endpoint by sending crafted requests remotely. Remediation There is no fixed version for...

Directory Traversal

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal via the WebSocket routing. An attacker can access unintended upstream endpoints by sending crafted WebSocket upgrade requests containing path traversal...

Arbitrary Code Injection

Overview uproot is a ROOT I/O in pure Python and NumPy. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TStreamerInfo metadata processing. An attacker can execute arbitrary Python code by supplying a crafted ROOT file containing malicious streamer metadata...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the RequestApproval function of the WebSocket Approval Endpoint in execapproval.go. An attacker can gain unauthorized access to resources or perform actions with insufficient authorization by sending crafted...

Incorrect Authorization

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Incorrect Authorization via the rewritePrefix param. An attacker can access restricted upstream paths by sending requests with URL-encoded characters in the prefix, bypassing...

Use of Incorrectly-Resolved Name or Reference

Overview Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the extractBin function in the file internal/tools/execapproval.go. An attacker can cause incorrect name resolution by manipulating input to this function, potentially leading to...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the isSafeBin function in the internal/tools/execapproval.go file. An attacker can gain unauthorized access to restricted functionality or data by exploiting insufficient authorization checks remotely...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the matchesAllowlist process. An attacker can gain unauthorized access to restricted actions by manipulating authorization checks. Remediation There is no fixed version for...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization via the isSafeBin function in the internal/tools/execapproval.go file. An attacker can gain unauthorized access to restricted functionality or data by exploiting insufficient authorization checks remotely...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview @fastify/reply-from is a forward your HTTP request to another server, for fastify Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' in the getUpstream function. An attacker can gain unauthorized access to or modify data across differen...

Malicious Package

Overview zlfr32573 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zzpdfvar05 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zwtenc3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zrgview2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zpx52534sg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zrgvbif79e is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zwkopt15 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zwtestabc4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zrgvhe14c is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zwtd104 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zjpage1 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zzlambtestf295 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview zztxtwtmp11 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview zzpdfvar03 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zztest17785553774 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview zztxtwtmp09 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview zzlambcalx1778552149 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview zzpdfvar06 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zzwandsxabc119 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview zwkact2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zztestno44 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zzfadgivar01 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview zwknum4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview zwkopt4 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...