Malicious Package

Overview chartkit-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview astlsi is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview qoeoe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview timeweave is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview tpu-raiden-jax is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview olympuslib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview pymaas is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview py-2equests is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview uvhttp-custom is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview asti is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview py-0requests is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview trongridi is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview py-1requests is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview 0requests is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview dynamo-run-script-jasmine-kuiperbelt is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview dandelion-dune-cli341-project is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview dailysmeltz3n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Prototype Pollution

Overview csv-parse is a parser converting CSV text input into arrays or objects. Affected versions of this package are vulnerable to Prototype Pollution in its duplicate-column handling, which assigns an array to obj'proto' when a header contains duplicate proto entries, triggering the proto sett...

Prototype Pollution

Overview org.webjars.npm:csv-parse is a parser converting CSV text input into arrays or objects. Affected versions of this package are vulnerable to Prototype Pollution in its duplicate-column handling, which assigns an array to obj'proto' when a header contains duplicate proto entries, triggerin...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in lib/parser.js, where the mutually recursive peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse to the input's nesting depth with no depth limit. An attacker can crash the process wi...

Uncontrolled Recursion

Overview Affected versions of this package are vulnerable to Uncontrolled Recursion in lib/parser.js, where the mutually recursive peg$parsevalue, peg$parsearray, and peg$parseinlinetableentry functions recurse to the input's nesting depth with no depth limit. An attacker can crash the process wi...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the deepRef function of lib/compiler.js, which traverses through a scalar value into the prototype chain, and whose containment guard is missed because currentPath inconsistently holds arrays that coerce to...

Prototype Pollution

Overview Affected versions of this package are vulnerable to Prototype Pollution in the deepRef function of lib/compiler.js, which traverses through a scalar value into the prototype chain, and whose containment guard is missed because currentPath inconsistently holds arrays that coerce to...

Improper Verification of Cryptographic Signature

Overview Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in the HMAC secret guard of jose/backends/native.py, which rejects a key only when ispemformatkey or issshkeykey holds and so never catches DER-encoded binary SubjectPublicKeyInfo public...

Directory Traversal

Overview rubyzip is a ruby module for reading and writing zip files. Affected versions of this package are vulnerable to Directory Traversal via Zip::Entryextract in lib/zip/entry.rb. An attacker can write files outside the intended extraction directory by supplying a crafted archive entry path...

Improper Verification of Cryptographic Signature

Overview node-forge is a JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in rsa.js, whose DigestInfo validation checks the out...

Improper Verification of Cryptographic Signature

Overview org.webjars.npm:node-forge is a WebJar for node-forge. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature in rsa.js, whose DigestInfo validation checks the outer element count obj.value.length !== 2 but never verifies the element count of...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the BSON-to-JSON conversion process when a binary field is encoded and the output is truncated at a specified length limit. An attacker can alter a small amount of data outside the intended buffer by supplying...

Incorrect Conversion between Numeric Types

Overview Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the JSON parsing process. An attacker can cause the library to read memory beyond the supplied buffer, return unintended data to the caller, or terminate the process by supplying a very larg...

Incorrect Conversion between Numeric Types

Overview Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the builder process when handling NUL-embedded document keys. An attacker can cause the application to read memory outside the intended buffer and terminate the calling process by supplying ...

Double Free

Overview Affected versions of this package are vulnerable to Double Free in the OCSP certificate revocation checking process during a TLS handshake with a trusted endpoint. An attacker can cause the client application to terminate unexpectedly by sending specially crafted certificate data that...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the JSON parsing process. An attacker can cause the application to terminate unexpectedly by supplying a specially crafted large JSON input, leading to memory corruption and potential denial of service...

Directory Traversal

Overview @fastify/http-proxy is a proxy http requests, for Fastify Affected versions of this package are vulnerable to Directory Traversal through the HTTP request path handling in index.js, including fastifyHttpProxy and reply.fromParameters. An attacker can bypass rewritePrefix path restriction...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via cancellation of downstream builds in Pipeline: Build Step Plugin. An attacker can cancel downstream Jenkins builds without the required Item/Cancel permission because the plugin fails to verify that the build's...

Host Confusion

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Host Confusion in the parse function, which returns a host that begins with but has no closing , such as @127.0.0.1, without validating it as an IPv6 literal or canonicalizing it as a...

Improper Encoding or Escaping of Output

Overview fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the recomposeAuthority function, which escapes the userinfo and host components but concatenates the port fie...

Improper Encoding or Escaping of Output

Overview org.webjars.npm:fast-uri is a Dependency-free RFC 3986 URI toolbox Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output that enables authority injection in the recomposeAuthority function, which escapes the userinfo and host components but...

Server-side Request Forgery (SSRF)

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through request-body validation in the proxy auth path. An authenticated user can supply routing or credential parameters such as apibase,...

Allocation of Resources Without Limits or Throttling

Overview github.com/golang/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its connection multiplexing, reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, which buffers...

Allocation of Resources Without Limits or Throttling

Overview github.com/golang/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the connection multiplexer's channel handling the mux chanList, reached through Dial, NewClientConn, NewControlClientConn, a...

Allocation of Resources Without Limits or Throttling

Overview golang.org/x/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its connection multiplexing, reached through Dial, NewClientConn, NewControlClientConn, and NewServerConn, which buffers unhandle...

Allocation of Resources Without Limits or Throttling

Overview golang.org/x/crypto/ssh is a SSH client and server Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the connection multiplexer's channel handling the mux chanList, reached through Dial, NewClientConn, NewControlClientConn, and...

Improper Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improper Authorization via the password reset process. An attacker can gain unauthorized access to administrator accounts by resetting passwords without providing the current password or havi...

Information Exposure

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Information Exposure in the @DataBoundConstructor process that loads script...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the Allure report publishing process. An attacker can access arbitrary files on the Jenkins controller's file system by exploiting insufficient path validation when reading files. Details A Directory Traversal...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the deserialization process of cached performance reports stored in the build directory on the controller. An attacker can execute arbitrary code by providing maliciously crafted serialized data,...

Incorrect Authorization

Overview astro is an Astro is a modern site builder with web best practices, performance, and DX front-of-mind. Affected versions of this package are vulnerable to Incorrect Authorization in BaseApp.removeBase, FetchState pathname stripping, and matchRequest in the routing and app base-handling...

Cross-site Scripting (XSS)

Overview sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the download process. An attacker can execute arbitrary JavaScript in the context of the application...

Incorrect Authorization

Overview sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework. Affected versions of this package are vulnerable to Incorrect Authorization in the PreviewLinkManager::generate process. An attacker can gain unauthorized access to restricted conte...

Incorrect Authorization

Overview sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework. Affected versions of this package are vulnerable to Incorrect Authorization through the MediaManager::move process. An attacker can gain unauthorized access to restricted media by...