Malicious Package

Overview raectjs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview motionspring is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview streak-key-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview chromecast-webdriver-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview chalk-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview chalk-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview chalk-es is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview chalk-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview lodash-lib is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview system-performance-helper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview nodealpha is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation through TransportSocketSnapshot in xds/src/main/java/com/linecorp/armeria/xds/TransportSocketSnapshot.java. An attacker can perform a man-in-the-middle attack against an xDS-managed upstream connection by...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference in the XML catalog parsing process when a nextCatalog element lacks the required catalog attribute. An attacker can cause the application to crash by supplying a specially crafted XML catalog file to an...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...

Symlink Attack

Overview Affected versions of this package are vulnerable to Symlink Attack through the Unpack and UnpackLayer routines in archive.go and diff.go. An attacker can create or overwrite files outside the intended extraction directory by supplying a crafted archive with traversal entries or symlink...

Reliance on Untrusted Inputs in a Security Decision

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Reliance on Untrusted Inputs in a Security Decision through the getTrustProxyFn hop-count handling in lib/request.js when trustProxy is configured as a number. An attacker can overwrite...

Improper Validation of Specified Type of Input

Overview fastify is an overhead web framework, for Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via the request validation path in lib/validation.js. An attacker can bypass body schema type enforcement by sending a root-level primitiv...

Server-side Request Forgery (SSRF)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the processing of JSON fields from an external API response in the device...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the graphdescr. configuration setting, which is rendered without proper escaping in...

Command Injection

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Command Injection in the AboutController process when the snmpget configuration parameter is manipulated to point to ...

Authorization Bypass Through User-Controlled Key

Overview @neo4j/graphql is an A GraphQL to Cypher query execution layer for Neo4j and JavaScript GraphQL implementations Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the isAuthenticated check in...

Authorization Bypass Through User-Controlled Key

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the upload and revoke. An attacker can cause unauthorized revocation of certificates at the certificate authority by...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the CertificateExport handler when the selected export plugin has requireskey set to False. An attacker can access certificate public data without prop...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the POST /api/1/authorities process when the ADMINONLYAUTHORITYCREATION configuration is set to False. An attacker can gain unauthorized control over...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the replaces. An attacker can suppress certificate expiration notifications and force the deployment of unauthorized certificates to endpoints by...

Missing Authorization

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Missing Authorization in the destinations API endpoints due to insufficient authorization checks. An attacker can access plaintext credentials, such as SFTP passwords and priva...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the acmeurl option during the authority update. An attacker can cause the backend to make arbitrary HTTP requests to internal or external...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via HTTP redirect following and DNS rebinding in the validaterevocationurl function. An authenticated attacker can supply a revocation URL CRL ...

Server-side Request Forgery (SSRF)

Overview lemur is a Certificate management and orchestration service Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the ACME client following server-controlled URLs in acmehandlers.py. A malicious or compromised ACME server can embed arbitrary internal UR...

Information Exposure

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Information Exposure in the API response handling process. An attacker can obtain sensitive credential material, including password hashes and TOTP 2FA seeds, by making authenticated...

Cross-site Request Forgery (CSRF)

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the editApiKey process. An attacker can modify API key properties, such as adding unauthorized IP addresses to the whitelist or extending the validi...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the DomainZones.add process. An attacker can inject unauthorized DNS resource...

SQL Injection

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to SQL Injection in the ipaddress parameter of the Admins.add or Admins.update process. An attacker can extract sensitive database information, including administrator login names and...

Cross-site Scripting (XSS)

Overview froxlor/froxlor is a server administration software. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the content processing of DNS TXT records. An attacker can execute arbitrary JavaScript in an administrator's browser session by injecting malicious payloa...

Missing Critical Step in Authentication

Overview devpi-server is a devpi-server: backend for hosting private package indexes and PyPI on-demand mirrors Affected versions of this package are vulnerable to Missing Critical Step in Authentication via the +changelog route when the replication protocol is enabled with the primary role. An...

Directory Traversal

Overview mineadmin/mineadmin is a Quickly build a background management system for web applications Affected versions of this package are vulnerable to Directory Traversal via the identifier parameter in the plugin installation and uninstallation process. An attacker can access or modify files...

Deserialization of Untrusted Data

Overview monai is an AI Toolkit for Healthcare Imaging Affected versions of this package are vulnerable to Deserialization of Untrusted Data via NumpyReader.read in monai/data/imagereader.py, which called numpy.load with allowpickle=True unconditionally. An attacker who can supply a malicious NPY...

Command Injection

Overview monai is an AI Toolkit for Healthcare Imaging Affected versions of this package are vulnerable to Command Injection via the datasetnameorid parameter in monai/apps/nnunet/nnunetv2runner.py. When constructing shell commands for nnUNet training, the runner incorporates the user-supplied...

Deserialization of Untrusted Data

Overview monai is an AI Toolkit for Healthcare Imaging Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the algofrompickle function. An attacker can execute arbitrary code by supplying a crafted pickle file that is deserialized without proper validation...

Predictable from Observable State

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Predictable from Observable State through the legacy client-initiated account linking endpoint in...

Authorization Bypass Through User-Controlled Key

Overview github.com/valyala/fasthttp is a fast HTTP server and client API. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the ServeFile and ServeFS functions. An attacker can bypass access controls by submitting double-encoded path variant...

Directory Traversal

Overview mobsf is a Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Affected versions of this package are vulnerable to Directory...

Cross-site Request Forgery (CSRF)

Overview mobsf is a Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Affected versions of this package are vulnerable to Cross-site...

Server-side Request Forgery (SSRF)

Overview mobsf is a Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Affected versions of this package are vulnerable to Server-side...

Denial of Service (DoS)

Overview mobsf is a Mobile Security Framework MobSF is an automated, all-in-one mobile application Android/iOS/Windows pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. Affected versions of this package are vulnerable to Denial of...

Missing Authorization

Overview @geolens/sdk is an Auto-generated TypeScript SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers. Affected versions of this package are vulnerable to Missing Authorization inadequate authorization checks on cross-dataset references in multiple API endpoints. An...

Missing Authorization

Overview geolens-cli is an Apache-2.0 command-line interface for the GeoLens API. Login, scan, publish, and export STAC against any GeoLens instance. Affected versions of this package are vulnerable to Missing Authorization inadequate authorization checks on cross-dataset references in multiple A...

Missing Authorization

Overview geolens is an Auto-generated Python SDK for the GeoLens API. Typed clients with Bearer + API-key auth helpers. Affected versions of this package are vulnerable to Missing Authorization inadequate authorization checks on cross-dataset references in multiple API endpoints. An attacker can...

Arbitrary Command Injection

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Arbitrary Command Injection in the deliverAlert process due to insufficient escaping of user-supplied input in the ex...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the manager.go file. An attacker can write files to arbitrary user-writable locations by convincing a user to install or execute a malicious plugin. Note: This is only exploitable if the plugin is not sourced fro...