Malicious Package

Overview ndmcjcxiebysfdb is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-alt-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview solo-async-pipe is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-diesel-store is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview subapp-pkg-util is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview node-env-buffer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview bnpl-blocks-atom-bnpl-search-input is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and...

Malicious Package

Overview efhthrthrthregerht is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-diesel-services is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview epic-diesel-form is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @mr-supun-fernando/supunmd-bail is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and th...

Malicious Package

Overview catplatebarcodeparser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview godzz is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview internallibv550 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decodeinteger function in src/hpack/hpack.py, where an attacker can send an HPACK-encoded integer with an unbounded number of continuation octets, causing run-away computation...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the actionGetResendModalContent process. An attacker can access sensitive submission data, including personally identifiable information, by invoking the control panel action without the required permissions...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in AsyncParser in parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker can exhaust CPU by sending untrusted JSON tokens split across many tiny chunks so each absorb call rescans the same...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in AsyncParser in parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker can exhaust CPU by sending untrusted JSON tokens split across many tiny chunks so each absorb call rescans the same...

Inefficient Algorithmic Complexity

Overview Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity in AsyncParser in parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker can exhaust CPU by sending untrusted JSON tokens split across many tiny chunks so each absorb call rescans the same...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Parser and AsyncParser recursive JSON parsing paths in parser/shared/src/main/scala/jawn/Parser.scala and parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Parser and AsyncParser recursive JSON parsing paths in parser/shared/src/main/scala/jawn/Parser.scala and parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling through the Parser and AsyncParser recursive JSON parsing paths in parser/shared/src/main/scala/jawn/Parser.scala and parser/shared/src/main/scala/jawn/AsyncParser.scala. An attacker...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS through the doSearchString text search routine in the org.jline.builtins.Nano editor. An attacker can hang the editor session and drive CPU usage high by entering a crafted regex search pattern...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more specific trailing-wildcard path by sending a request that matches a broader...

Incorrect Authorization

Overview github.com/hashicorp/vault/vault is a tool for securely accessing secrets. Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization through the AllowOperation path-matching logic in vault/policy/acl.go. An attacker can perform an unauthorized LIST request on a more specific trailing-wildcard path by sending a request that matches a broader...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the Less viewer search and display-filter matching in builtins/src/main/java/org/jline/builtins/Less.java. An attacker can hang the session thread by supplying a malicious search or filter...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the formie/submissions/submit action. An attacker can overwrite or hijack another user's incomplete submission by supplying a crafted submissionId parameter without proper session binding, ownership validation,...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the formie/integrations/form-settings action in the control panel. An attacker can access and modify integration settings, potentially exfiltrating stored API keys or OAuth tokens by redirecting...

SQL Injection

Overview sulu/sulu is a highly extensible open-source PHP content management system based on the Symfony framework. Affected versions of this package are vulnerable to SQL Injection via the categories query parameter in the Smart Content category filter. An attacker can infer the existence of, an...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the grep command in builtins/src/main/java/org/jline/builtins/PosixCommands.java. An attacker can hang the command thread by supplying a pattern such as a++b against non-matching input, whic...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in reader/src/main/java/org/jline/reader/impl/history/DefaultHistory.java through matchPatterns in the HISTORYIGNORE history filter. An attacker can hang the reader thread and drive CPU usage...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the ctl.c process when handling topology files. An attacker can cause the application to read beyond the bounds of the topology buffer, potentially leaking sensitive data or causing a crash, by supplyin...

Improper Validation of Array Index

Overview Affected versions of this package are vulnerable to Improper Validation of Array Index via the pcmmulti process. An attacker can cause the application to abort by supplying a crafted ALSA configuration file containing sparse bindings that trigger an out-of-bounds array read and assertion...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the movreadispe and readimagegrid paths in libavformat/mov.c. An attacker can trigger the flaw by supplying a crafted HEIF file with oversized ispe width and height values, causing them to be stored as...

Improper Neutralization of Special Elements Used in a Template Engine

Overview solspace/craft-freeform is a flexible and user-friendly form building plugin! Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the rendering of submitted form field values in an isolated Twig context. An attacke...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the updatePost process. An attacker can alter the publication status or content of their own posts without the required editorial approval by submitting crafted GraphQL mutations as an authenticated Contributo...

Cross-site Request Forgery (CSRF)

Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF in the rexapiinstallpackageupdate process. An attacker can trigger unauthorized addon updates by luring an authenticated admin to visit a malicious page, causing unintended package updates or downgrades t...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the rendering of unescaped filenames from the filesystem in the backend sync page. An attacker can execute arbitrary JavaScript in the browser of backend users by placing specially crafted files with malicio...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the mediaIsInUse function. An attacker can execute arbitrary JavaScript in the context of an administrator's browser session by injecting malicious payloads into the type name field, which are rendered...

Allocation of Resources Without Limits or Throttling

Overview zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via getcontentdecoder in src/zapros/models.py, where an attacker can send an HTTP response with an unbounded number of...

Allocation of Resources Without Limits or Throttling

Overview zapros is a Modern and extensible HTTP client for Python. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via decompression of streaming responses in decoders.py, where compressed content gzip, deflate, or brotli is decompressed...

Authentication Bypass by Alternate Name

Overview org.apache.tomcat:tomcat is an implementation of the Java Servlet, JavaServer Pages, Java Expression Language and Java WebSocket technologies. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via the WebSocket endpoint security constraint...

Authentication Bypass by Alternate Name

Overview org.apache.tomcat:tomcat-websocket is a Tomcat WebSocket JSR356 implementation. Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via the WebSocket endpoint security constraint handling. An attacker can gain unauthorized access to protected...

Authentication Bypass by Alternate Name

Overview Affected versions of this package are vulnerable to Authentication Bypass by Alternate Name via the WebSocket endpoint security constraint handling. An attacker can gain unauthorized access to protected resources by connecting to endpoints using alternate names. Remediation Upgrade...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication due to OCSP handling in the OpenSSL Panama OpenSSLEngine. An attacker can authenticate with a client certificate that is not checked through OCSP by presenting a certificate with no usable OCSP responder URL to a...

Missing Release of Resource after Effective Lifetime

Overview org.apache.tomcat:tomcat-websocket is a Tomcat WebSocket JSR356 implementation. Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the WebSocket write timeout handling in org.apache.tomcat.websocket.WsRemoteEndpointImplBase,...

Missing Release of Resource after Effective Lifetime

Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime through the WebSocket write timeout handling in org.apache.tomcat.websocket.WsRemoteEndpointImplBase, WsRemoteEndpointImplClient, WsRemoteEndpointImplServer, and MessagePart. An...

Use After Free

Overview sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Use After Free in entityinsert and the entity map held on XmlState, which is shared between the outer parse an...

Use After Free

Overview org.webjars.npm:sharp is a High performance Node.js image processing, the fastest module to resize JPEG, PNG, WebP, GIF, AVIF and TIFF images Affected versions of this package are vulnerable to Use After Free in entityinsert and the entity map held on XmlState, which is shared between th...