Improper Verification of Cryptographic Signature

Overview PyJWT is a Python implementation of RFC 7519. Affected versions of this package are vulnerable to Improper Verification of Cryptographic Signature via the preparekey method in jwt/algorithms.py, where DER-encoded public keys are accepted as HMAC secrets without rejection. An attacker who...

Infinite loop

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Infinite loop via the afterdoctypenamestate handler in Domino's HTML parser lib/HTMLParser.js, used by @angular/platform-server for server-side rendering. Whe...

Improper Encoding or Escaping of Output

Overview @angular/platform-server is an Angular - library for using Angular in Node.js Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the bundled domino dependency, which is used for server-side DOM emulation during Angular Universal rendering. An...

Insufficient Verification of Data Authenticity

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Insufficient Verification of Data Authenticity in OAuthClientProvider, ClientCredentialsOAuthProvider, PrivateKeyJWTOAuthProvider, and the deprecated 1.x RFC7523OAuthClientProvider, which accept the...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling across multiple request-processing helpers lib/helpers/resolveConfig.js,...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling across multiple request-processing helpers lib/helpers/resolveConfig.js,...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper enforcement of maxRedirects: 0 in the fetch adapter, where user-supplied fetchOptions are...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via improper enforcement of maxRedirects: 0 in the fetch adapter, where user-supplied fetchOptions are merged into the...

Improper Validation of Specified Type of Input

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via isHostInSubnet and isInSubnet which delegates to it, which compares masked...

Improper Validation of Specified Type of Input

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Improper Validation of Specified Type of Input via isHostInSubnet and isInSubnet which delegates to it, which compares masked binary strings...

Incorrect Behavior Order

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Incorrect Behavior Order via the isLinkLocal method, which incorrectly compared only the first 64 bits of an IPv6 address against...

Incorrect Behavior Order

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Incorrect Behavior Order via the isLinkLocal method, which incorrectly compared only the first 64 bits of an IPv6 address against the fixed patte...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an...

Allocation of Resources Without Limits or Throttling

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the Address6.isValid method and the Address4 constructor when parsing an oversized input...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and...

Server-side Request Forgery (SSRF)

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via isPrivate in src/ipv6.ts, which fails to classify addresses in the RFC 8215 NAT64 local-use...

Server-side Request Forgery (SSRF)

Overview ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via isPrivate in src/ipv6.ts, which fails to classify addresses in the RFC 8215 NAT64 local-use range...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and related helpers...

Directory Traversal

Overview decompress is a package that can be used for extracting archives. Affected versions of this package are vulnerable to Directory Traversal via symlink extraction in index.js, where symlinks whose targets resolve outside the output directory are not validated before being written to disk. ...

Directory Traversal

Overview @xhmikosr/decompress is an Extracting archives made easy Affected versions of this package are vulnerable to Directory Traversal via symlink extraction in index.js, where symlinks whose targets resolve outside the output directory are not validated before being written to disk. An attack...

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are...

Improper Validation of Specified Quantity in Input

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are...

Improper Validation of Specified Quantity in Input

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...

Improper Validation of Specified Quantity in Input

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Validation of Specified Quantity in Input via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...

Server-side Request Forgery (SSRF)

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unsafe merging of user-supplied fetchOptions into the resolved request options object in lib/adapters/fetch.js. An...

Server-side Request Forgery (SSRF)

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via unsafe merging of user-supplied fetchOptions into the resolved request options object in lib/adapters/fetch.js. An attacker who...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficiently hardened runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via insufficiently hardened runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js, lib/adapters/http.js, and related helpers,...

Improper Input Validation

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merge...

Improper Input Validation

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Improper Input Validation via insufficient hardening of runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into the...

Allocation of Resources Without Limits or Throttling

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions a...

Allocation of Resources Without Limits or Throttling

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via unsafe runtime option handling in the fetch and HTTP adapters, where user-supplied fetchOptions are merged into t...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via improper validation of runtime options in resolveConfig and related helpers, where an attacker-controlled o...

Regular Expression Denial of Service (ReDoS)

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS via improper validation of runtime options in resolveConfig and related helpers, where an attacker-controlled or malformed...

Prototype Pollution

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via unsafe merging of user-supplied fetchOptions in lib/adapters/fetch.js. When a caller passes a fetchOptions object, axios spreads i...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview org.webjars.npm:axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via insufficient hardening of runtime option handling in the fetch and HTTP adapters...

Unintended Proxy or Intermediary ('Confused Deputy')

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' via insufficient hardening of runtime option handling in the fetch and HTTP adapters lib/adapters/fetch.js,...

Prototype Pollution

Overview axios is a promise-based HTTP client for the browser and Node.js. Affected versions of this package are vulnerable to Prototype Pollution via unsafe merging of user-supplied fetchOptions in lib/adapters/fetch.js. When a caller passes a fetchOptions object, axios spreads it directly into...

Malicious Package

Overview eslint-plugin-skywagon-web is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview fabric-asset-pipeline is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview figlet-chalk-render is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview simple-date-formatter-new-12 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview chalk-figlet is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview nebulaai-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview native-runner is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview nebula-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview img-to-native is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview git-en-boite-logging is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview tailwindcss-form-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview vite-plugin-crypto is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...