Malicious Package

Overview hardhat-gas-profiler-plugin is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview foundy-toolkit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview env-security-scanner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview solidity-deploy-guard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview mnemonic-safety-check is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview foundry-deploy-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview wallet-security-checker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview defi-env-auditor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview solna-web3 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Improper Check for Certificate Revocation

Overview Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the SignatureKey verification process. An attacker can bypass revocation enforcement by presenting a certificate with a revoked SignatureKey, potentially allowing unauthorized access or trust...

Improper Check for Certificate Revocation

Overview Affected versions of this package are vulnerable to Improper Check for Certificate Revocation in the SignatureKey verification process. An attacker can bypass revocation enforcement by presenting a certificate with a revoked SignatureKey, potentially allowing unauthorized access or trust...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the concrete/controllers/dialog/event/duplicate process. An attacker can perform unauthorized actions on behalf of an authenticated user by tricking...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the star function in the backend file controller. An attacker can perform unauthorized actions on behalf of an authenticated user by tricking them...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the concrete/controllers/dialog/logs/bulk/delete process. An attacker can perform unauthorized actions on behalf of an authenticated user by trickin...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the concrete/controllers/dialog/express/association/reorder process. An attacker can perform unauthorized actions on behalf of an authenticated user...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the rescan process in concrete/controllers/backend/file. An attacker can perform unauthorized actions on behalf of an authenticated user by tricking...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the removeFavoriteFolder process. An attacker can perform unauthorized actions on behalf of an authenticated user by tricking them into submitting a...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the approveVersion function in the backend file controller. An attacker can perform unauthorized actions on behalf of an authenticated user by...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the concrete/controllers/dialog/page/bulk/cache process. An attacker can perform unauthorized actions on behalf of an authenticated user by tricking...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the concrete/controllers/dialog/logs/delete process. An attacker can perform unauthorized actions on behalf of an authenticated user by tricking the...

Sensitive Cookie with Improper SameSite Attribute

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute via the concrete/controllers/dialog/page/bulk/design process. An attacker can perform unauthorized actions on behalf of an authenticat...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the concrete/controllers/dialog/page/bulk/delete process. An attacker can perform unauthorized actions on behalf of an authenticated user by trickin...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the addFavoriteFolder function in the backend file controller. An attacker can perform unauthorized actions on behalf of an authenticated user by...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Concrete\Core\Legacy\Pagination process. An attacker can execute arbitrary scripts in the context of an authenticated admin or report viewer's session ...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the rescanMultiple process in the backend file controller. An attacker can perform unauthorized actions on behalf of an authenticated user by tricki...

Missing Authorization

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Missing Authorization via the /ccm/system/dialogs/file/usage/fID endpoint. An attacker can access internal site structure data, including page IDs, versions, and URL paths, by sending ...

Missing Authorization

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Missing Authorization via the /ccm/frontend/conversations/getrating endpoint, which confirms existence and returns the rating score for any message by its identifier. An attacker can...

Missing Authorization

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Missing Authorization via the /ccm/frontend/conversations/messagepage endpoint. An attacker can access the full content of any conversation message, including those from restricted...

Cross-site Request Forgery (CSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the DeleteFile controller process. An attacker can trigger unauthorized file deletions by inducing a user with permission to edit conversation...

Authorization Bypass Through User-Controlled Key

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the AddMessage and UpdateMessage process via the attachments parameter. An attacker can bypass file permission restrictions by...

Access Control Bypass

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Access Control Bypass via the summary template process. An attacker can obtain sensitive metadata, including title, path, description, and author information of private, draft, and...

Cross-site Scripting (XSS)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the updateCollectionAliasExternal process. An attacker can execute arbitrary JavaScript code in the context of a user's browser by submitting crafted input...

Improper Privilege Management

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Improper Privilege Management in the user-profile edit controller process. An attacker can change another user's password and disable per-user-IP-pinning in the session validator by...

Missing Authorization

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Missing Authorization in the submitpassword process. An attacker can gain unauthorized access to files by bypassing permission checks when downloading files, including those protected ...

Server-side Request Forgery (SSRF)

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the RSS Displayer process. An attacker can access internal resources by supplying a crafted feed URL that is fetched server-side without validation...

Authorization Bypass Through User-Controlled Key

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the exEntryID parameter in the Express Entry Detail block. An attacker can gain unauthorized access to all Express form submissions...

Missing Authorization

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Missing Authorization via the /ccm/frontend/conversations/messagedetail endpoint. An attacker can access the full content of any conversation message, including those from restricted...

Improper Validation of Specified Type of Input

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the OAuth 2.0 Authorization-Code Handler. An attacker can gain unauthorized access to resources by authenticating with an account tha...

Incorrect Authorization

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Incorrect Authorization via the /user/update endpoint. An attacker can gain full administrative access by modifying their own userrole field to proxyadmin to escalate...

Incorrect Authorization

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Incorrect Authorization via the allowedroutes field during API key generation. An attacker can gain unauthorized access to restricted routes by specifying routes outside...

Authorization Bypass Through User-Controlled Key

Overview concrete5/concrete5 is a concrete5 open source CMS. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the surveys process. An attacker can gain unauthorized access to restricted survey functionality by submitting a restricted option ...

Origin Validation Error

Overview network-ai is an AI agent orchestration framework for TypeScript/Node.js - 29 adapters LangChain, AutoGen, CrewAI, OpenAI Assistants, LlamaIndex, Semantic Kernel, Haystack, DSPy, Agno, MCP, OpenClaw, A2A, Codex, MiniMax, NemoClaw, APS, Copilot, LangGraph, Anthropic Compu Affected version...

Insecure Randomness

Overview Magick.NET-Q16-HDRI-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Insecure Randomness

Overview Magick.NET-Q16-arm64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Insecure Randomness

Overview Magick.NET-Q16-HDRI-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Insecure Randomness

Overview Magick.NET-Q16-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package a...

Insecure Randomness

Overview Magick.NET-Q16-HDRI-OpenMP-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this...

Insecure Randomness

Overview Magick.NET-Q16-HDRI-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Insecure Randomness

Overview Magick.NET-Q16-x86 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...

Insecure Randomness

Overview Magick.NET-Q16-x64 is a Magick.NET allows you can use ImageMagick without having to install ImageMagick on your server or desktop. More information about specific builds see the official docs https://github.com/dlemstra/Magick.NET/tree/main/docs Affected versions of this package are...