Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the webhook registration process. An attacker can access internal network resources by registering internal URLs and triggering alarm threshold breaches, which causes the server to issue POST requests...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the OAuth callback controller process. An attacker can execute arbitrary JavaScript in authenticated users' browsers by crafting malicious OAuth callback URLs containing unsanitized error query parameters...

Missing Authorization

Overview com.yahoo.elide:elide-core is a library that lets you stand up a GraphQL/JSON-API web service with minimal effort. Affected versions of this package are vulnerable to Missing Authorization in the SortingImpl.getValidSortingRules process. An attacker can infer the values of restricted...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the SortingImpl.getValidSortingRules process. An attacker can infer the values of restricted fields by analyzing the order of rows returned through both JSON:API and GraphQL read paths. Remediation There is no...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the alert rule store process. An attacker can read, modify, or delete alert rules belonging to other organizations by supplying a target rule UUID and bypassing multi-tenant access...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the alert rule store process. An attacker can read, modify, or delete alert rules belonging to other organizations by supplying a target rule UUID and bypassing multi-tenant access...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the alert rule store process. An attacker can read, modify, or delete alert rules belonging to other organizations by supplying a target rule UUID and bypassing multi-tenant access...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the alert rule store process. An attacker can read, modify, or delete alert rules belonging to other organizations by supplying a target rule UUID and bypassing multi-tenant access...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection in the rule ID path parameter of the alert-history endpoints. An attacker can execute arbitrary database queries and access sensitive data by injecting specially crafted input. This may also allow the attacker to perform...

Improper Authorization

Overview Affected versions of this package are vulnerable to Improper Authorization in the token endpoint when the codeVerifierEnforced setting is disabled. An attacker can obtain access tokens without providing the required PKCE code verifier by intercepting an authorization code and redeeming i...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the privatekeyjwt authentication process. An attacker can generate access tokens as another client by exploiting the JWKS resolver cache, without possessing the victim's signing key, if the target client has...

Protection Mechanism Failure

Overview Affected versions of this package are vulnerable to Protection Mechanism Failure in the server-side scripting sandbox due to insufficient protection mechanisms. An attacker can execute arbitrary operating system commands by escaping the Groovy sandbox with default class allow and deny...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information in the process that handles SSID allowlist checks for internal network connections. An attacker can intercept sensitive information, such as access tokens and sensor data, by connecting th...

SQL Injection

Overview snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to SQL Injection through the processing of attacker-controlled content in repository data, project configuration, manifest data, or specification input. An attacker can execute unintended SQL statements in...

SQL Injection

Overview snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to SQL Injection via improper neutralization of local CLI parameters in the Cortex SQL or object listing command paths. An attacker can execute unintended SQL statements within the context of the current...

Authentication Bypass by Primary Weakness

Overview Affected versions of this package are vulnerable to Authentication Bypass by Primary Weakness due to improper privilege handling in the Project Owner role. An attacker can gain unauthorized access to host-level privileges by exploiting insufficient access control mechanisms. Remediation...

Directory Traversal

Overview snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to Directory Traversal via improper restriction of file path resolution. An attacker can access and exfiltrate arbitrary local files by supplying crafted project or repository content that references files...

Arbitrary Code Injection

Overview snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to Arbitrary Code Injection in the Snowpark annotation processor template. An attacker can execute arbitrary code by supplying crafted project content that is interpolated into generated Python code during...

Insertion of Sensitive Information into Log File

Overview snowflake-cli is a Snowflake CLI Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the debug logging process. An attacker can access sensitive credentials by obtaining read access to local log files. This is only exploitable if...

Malicious Package

Overview autotel-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview autotel-backends is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @webda-infra-ui/static-images is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @webd-infra/query-designer-domain is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @bc-workspace/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview sorenson-webfonts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @bodata/angular-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @cseo-hr/trpweb-shared is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview @sixt-payment/form-react is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview ui-ng-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview via-city-tools-m-particle is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @digitalpharmacist/http-error-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview @citi-icg-171632/citicms-repo-component is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organizatio...

Malicious Package

Overview @contentprod-authoring/block-manager is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview wm-mapper is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @appsource/utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview uipath-sugar-sell is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @cloudways-lab/unified-design-system is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview @deel-ui/animation is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @webda-infra/search is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @concerns/i18n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @deel-core/client-payroll-onboarding-types is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview @bscom/styling is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tivo-codelib-a is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview unleash-js is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @webda-features/dashboard is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @alerts/components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @tbe-ui/ides is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @planetlabs/admin-ng is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @report-portal/service-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @piewasm/pie-web-npm-package is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...