Malicious Package

Overview items-validator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview mini-hardhat is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview hardhat-zet is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview rai6jaisahthaghee5ou-loader-package is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization an...

Malicious Package

Overview native-env is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview fabric-native-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview dotenv-native is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview xeprews is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview exprrdd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview test-agency-assignment is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview aseitylab is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview exptrdd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview exptred is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview express-nodejs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview express-javascript is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview exptredd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview exprdd is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Missing Authorization

Overview pretix is a Reinventing presales, one ticket at a time Affected versions of this package are vulnerable to Missing Authorization via a missing permission check that allows low-privileged users who have access to an event, but lack access to the event's orders, to extract sensitive...

Insertion of Sensitive Information into Log File

Overview apache-airflow-providers-teradata is a Provider package apache-airflow-providers-teradata for Apache Airflow Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the execute method in azureblobtoteradata.py and s3toteradata.py, when no...

Insufficiently Protected Credentials

Overview apache-airflow-providers-snowflake is a Provider package apache-airflow-providers-snowflake for Apache Airflow Affected versions of this package are vulnerable to Insufficiently Protected Credentials via unsanitized interpolation of the account and region connection fields into Snowflake...

Improper Neutralization of Special Elements in Data Query Logic

Overview apache-airflow-providers-google is a Provider for Apache Airflow. Implements apache-airflow-providers-google package Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic via GoogleDriveHook in drive.py, where folder names, fi...

SQL Injection

Overview apache-airflow-providers-teradata is a Provider package apache-airflow-providers-teradata for Apache Airflow Affected versions of this package are vulnerable to SQL Injection in the Teradata compute-cluster example DAG, where user-settable Params are not properly constrained, allowing an...

Command Injection

Overview org.webjars.npm:shell-quote is a package used to quote and parse shell commands. Affected versions of this package are vulnerable to Command Injection via the quote function when a comment token is followed by a string token containing a line terminator. A comment token emits a -prefixed...

Command Injection

Overview shell-quote is a package used to quote and parse shell commands. Affected versions of this package are vulnerable to Command Injection via the quote function when a comment token is followed by a string token containing a line terminator. A comment token emits a -prefixed string that...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the pbkdf2 function in lib/sync.js, which passes the raw password to createHmac on every PBKDF2 iteration. Because HMAC rehashes any key longer than the digest's block size per RF...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the pngreadend process when it is called without reading image rows. An attacker can cause an application crash by supplying a specially crafted PNG image that triggers incomplete decompression of certain metadata...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the preparekey method in jwt/algorithms.py, where a public JWK container such as a JWK Set with a kty member nested inside a JSON array o...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the preparekey method in jwt/algorithms.py, where an encoded JWK such as an RSA public key is accepted as a valid HMAC secret without...

Improper Handling of Exceptional Conditions

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Handling of Exceptional Conditions via the PyJWK constructor in jwt/apijwk.py when processing a JWK set containing a malformed key. An attacker who can supply a JWK set with a...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the fromjwk function in jwt/algorithms.py when loading an OKP Octet Key Pair private key from a JWK. The function constructs the private...

Uncontrolled Recursion

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Uncontrolled Recursion via the load method in jwt/apijws.py when parsing a JWT with a deeply nested recursive JSON structure in the header. An attacker can supply a JWT whose header contains...

Uncontrolled Recursion

Overview org.webjars.npm:brace-expansion is a WebJar for brace-expansion. Affected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in expand when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces...

Uncontrolled Recursion

Overview brace-expansion is a Brace expansion as known from sh/bash Affected versions of this package are vulnerable to Uncontrolled Recursion via uncontrolled recursion in expand when processing deeply nested brace patterns. An attacker can supply approximately 6 KB of deeply nested braces e.g.,...

Uncontrolled Recursion

Overview org.webjars.npm:brace-expansion is a WebJar for brace-expansion. Affected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in parseCommaParts. In the first, the function recurses on the remainder of the string once per brace group,...

Uncontrolled Recursion

Overview brace-expansion is a Brace expansion as known from sh/bash Affected versions of this package are vulnerable to Uncontrolled Recursion via two distinct stack-exhaustion paths in parseCommaParts. In the first, the function recurses on the remainder of the string once per brace group, so a...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:brace-expansion is a WebJar for brace-expansion. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the expand function, which implements a Bash quirk where a brace group followed by a comma set e.g. a,b causes the parser to...

Regular Expression Denial of Service (ReDoS)

Overview brace-expansion is a Brace expansion as known from sh/bash Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via the expand function, which implements a Bash quirk where a brace group followed by a comma set e.g. a,b causes the parser to rewri...

Uncaught Exception

Overview @nestjs/microservices is a Nest - modern, fast, powerful node.js web framework @microservices Affected versions of this package are vulnerable to Uncaught Exception via unguarded JSON.stringify calls on client-controlled message patterns in the TCP and RMQ server handlers...

Weak Authentication

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Weak Authentication via the JWT authentication flow's email-based fallback lookup, which does not verify the emailverified claim before resolving a user identity. An attack...

Partial String Comparison

Overview @grpc/grpc-js-xds is a Plugin for @grpc/grpc-js. Adds the xds:// URL scheme and associated features. Affected versions of this package are vulnerable to Partial String Comparison via the PathExactValueMatcher.apply method in matcher.ts, where the case-insensitive exact path match...

Server-generated Error Message Containing Sensitive Information

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Server-generated Error Message Containing Sensitive Information via the server-side RPC error handler in server.ts, which unconditionally includes the raw exception message in the gRPC status...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via PyJWKClient.getsigningkey in jwt/jwksclient.py, where an attacker can repeatedly present tokens with unknown key IDs, causing the client to perform an unbounded number of forced...

Improper Certificate Validation

Overview @grpc/grpc-js is a gRPC Library for Node Affected versions of this package are vulnerable to Improper Certificate Validation via getAuthContext in server-interceptors.ts and the TLS session handling in transport.ts, where the authorized property of a TLS socket is not checked before...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the verifysignature method in jwt/apijws.py when a PyJWK object is used to verify an HMAC-signed token. In the vulnerable code path,...

Uncaught Exception

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Uncaught Exception via decodepayload in jwt/apijwt.py, where a JWT token containing a deeply nested JSON payload triggers an unhandled RecursionError during json.loads parsing. An attacker c...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via ispemformat in jwt/utils.py, which previously used a regex PEMRE that accepted PEM formatting variants recognised by the underlying cryptography loader but not explicitly validated by pyjwt...

Incorrect Behavior Order: Validate Before Canonicalize

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Incorrect Behavior Order: Validate Before Canonicalize via the load method in jwt/apijws.py, which accepts non-canonical base64url-encoded JWS segments. Because the library does not verify...

Improper Verification of Cryptographic Signature

Overview authlib is a library in building OAuth and OpenID Connect servers. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the JsonWebSignature.deserializejson method in the JWS JSON serialization handling. An attacker can have unsigned or...

Open Redirect

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Open Redirect via the fetchdata method in jwt/jwksclient.py, which follows HTTP redirects when fetching a JWK Set from a remote URI. An attacker who can influence the JWKS endpoint URL or...

Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via ispemformat in jwt/utils.py, which fails to recognize certain loader-accepted PEM formatting variants as valid PEM. The fix for...