Regular Expression Denial of Service (ReDoS)

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the AUTH mechanism detection of SMTPConnection.actionEHLO in src/smtp-connection/index.ts, where all four patterns...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the AUTH mechanism detection of SMTPConnection.actionEHLO in src/smtp-connection/index.ts, where a...

Inefficient Algorithmic Complexity

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the isPartialResponse function and the onData method of SMTPConnection in src/smtp-connection/index.ts,...

Inefficient Algorithmic Complexity

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in the isPartialResponse function and the onData method of SMTPConnection in src/smtp-connection/index.ts, where each...

Improper Adherence to Coding Standards

Overview org.webjars.npm:nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Improper Adherence to Coding Standards in the checkChar method of the Tokenizer class in src/addressparser/index.ts, where operatorExpecting hol...

Improper Adherence to Coding Standards

Overview nodemailer is an Easy as cake e-mail sending from your Node.js applications Affected versions of this package are vulnerable to Improper Adherence to Coding Standards in the checkChar method of the Tokenizer class in src/addressparser/index.ts, where operatorExpecting holds a single...

Uncaught Exception

Overview org.webjars.npm:qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception via stringify when arrayFormat: 'comma' is used with array elements that have a non-callable toString property. Such...

Uncaught Exception

Overview qs is a querystring parser that supports nesting and arrays, with a depth limit. Affected versions of this package are vulnerable to Uncaught Exception via stringify when arrayFormat: 'comma' is used with array elements that have a non-callable toString property. Such elements - as...

Malicious Package

Overview py-worm is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview saeka is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview seapy-ops is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview py-sock2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @flexmr/ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview tailwindcss-uniform is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview util-foriepft is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Incorrect Authorization

Overview io.vertx:vertx-web is a HTTP web applications for Vert.x. Affected versions of this package are vulnerable to Incorrect Authorization in the postAuthentication method of ChainAuthHandler, which depends on internal state set only during the authenticate phase, so when a preceding handler...

HTTP Request Smuggling

Overview io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to HTTP Request Smuggling due to inconsistent interpretation of headers in the isContentLength and isContentType helpers of the VertxHttpRequestDecoder class,...

Improper Certificate Validation

Overview io.vertx:vertx-core is a tool-kit for building reactive applications on the JVM. Affected versions of this package are vulnerable to Improper Certificate Validation in the client SSL context cache of the SslContextManager class, whose cache key compared only the key and trust options and...

Malicious Package

Overview @xxxfnbs21/hello-demo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Command Injection

Overview xhtml2pdf is a PDF generator using HTML and CSS Affected versions of this package are vulnerable to Command Injection in the startViewer function in xhtml2pdf/pisa.py, whose fallback path interpolates the file name into a shell string as os.system'open "%s"' % filename after os.startfile...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the multidone function in lib/multi.c, whose cleanup order ran multischedulepending before the connection was detached and the connection filters had given up their references to the struct Curleasy. An attacker runnin...

Malicious Package

Overview sysdiagd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview pyyi is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview crelic-bqwheel-52f66a3f1d is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview fontcase is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @mntv-analysis/workspaces-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview @mntv-analysis/ui-components is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview @newspage/libx-amount is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @mntv-analysis/ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @user-interface-common/common-styles is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization a...

Malicious Package

Overview passwordcrackv2 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @accenturecodefoundry/mfe-pot-shared-ui-scds-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview @kre64/hello-npm-test is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview passwordcracker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview monkey-tags-ip is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @newspage/lib-ng-async-routes-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Insufficient Session Expiration

Overview org.webjars.npm:auth0-js is a Client Side Javascript toolkit for Auth0 API. Affected versions of this package are vulnerable to Insufficient Session Expiration via the WebAuth authorize/parseHash transaction flow in src/web-auth/index.js and src/web-auth/transaction-manager.js. An attack...

Insufficient Session Expiration

Overview auth0-js is an Auth0 headless browser sdk Affected versions of this package are vulnerable to Insufficient Session Expiration via the WebAuth authorize/parseHash transaction flow in src/web-auth/index.js and src/web-auth/transaction-manager.js. An attacker can submit an ID token from an...

Use of GET Request Method With Sensitive Query Strings

Overview org.webjars.npm:auth0-lock is a WebJar for auth0-lock. Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings via the Active Directory login flow in the auth0-lock enterprise authentication components. An attacker can expose the user's...

Use of GET Request Method With Sensitive Query Strings

Overview auth0-lock is a plugin for Auth0. Affected versions of this package are vulnerable to Use of GET Request Method With Sensitive Query Strings via the Active Directory login flow in the auth0-lock enterprise authentication components. An attacker can expose the user's Active Directory...

Open Redirect

Overview @auth0/nextjs-auth0 is a Next.js SDK for signing in with Auth0 Affected versions of this package are vulnerable to Open Redirect via the returnTo parameter, where the SDK validates it as a same-origin URL but the subsequent reconstruction logic can produce a URL that browsers interpret a...

Improper Handling of Exceptional Conditions

Overview Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the token parsing process. An attacker can cause the service to terminate threads and degrade availability by submitting JWTs with timestamp claims containing out-of-range values...

Deadlock

Overview Microsoft.AspNetCore.App.Runtime.linux-arm is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling process...

Deadlock

Overview Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling process. An attacker can cause the server to become unresponsive and exhaust system resources by sending crafted HTTP/3 reset or abort sequences that trigger excessive blocked-thread creation...

Deadlock

Overview Microsoft.AspNetCore.App.Runtime.win-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling process...

Deadlock

Overview Microsoft.AspNetCore.App.Runtime.win-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling process. A...

Deadlock

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling...

Deadlock

Overview Microsoft.AspNetCore.App.Runtime.linux-musl-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling...

Deadlock

Overview Microsoft.AspNetCore.App.Runtime.linux-x64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling process...

Deadlock

Overview Microsoft.AspNetCore.App.Runtime.linux-arm64 is a package providing a default set of APIs for building an ASP.NET Core application. Contains assets used for self-contained deployments. Affected versions of this package are vulnerable to Deadlock via the Kestrel connection handling proces...