Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the ImportExportController AJAX handlers due to insufficient enforcement of granular access control. An attacker can access or modify sensitive data by invoking import or export operations through AJAX handler...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the preview and update actions in the backend account management process. An attacker can access sensitive profile information of other backend users by supplying arbitrary user IDs i...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the evalImageTypeValue process. An attacker can inject arbitrary attributes, including event handlers, into the backend list by supplying specially crafted values that are rendered in an image column, leading...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of =include and =require directives in JavaScript asset compilation. An attacker can disclose arbitrary files readable by the PHP process by crafting directives that escape the intended asset...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop through the readFieldSection process. An attacker can cause the application to enter an infinite loop and exhaust CPU resources by sending a specially crafted Binary HTTP message with a manipulated field-section length,...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the processing of @import directives in LESS compilation within backend customizable stylesheets and theme assets. An attacker can disclose arbitrary files readable by the PHP process by injecting crafted import...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the lack of enforced limits on variable length fields in the BinaryHttpParser. An attacker can exhaust system memory by sending specially crafted requests with excessively larg...

Infinite loop

Overview Affected versions of this package are vulnerable to Infinite loop in the readFieldSection process. An attacker can cause the parsing thread to enter an infinite loop by sending a specially crafted Binary HTTP input where a known-length field section ends exactly after a complete field...

Incorrect Conversion between Numeric Types

Overview Affected versions of this package are vulnerable to Incorrect Conversion between Numeric Types in the BinaryHttpParser process. An attacker can cause the decoder to crash and disrupt service availability by sending a specially crafted Binary HTTP payload with large variable-length intege...

Insertion of Sensitive Information into Log File

Overview Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File in the toString process and exception message handling, where raw HPKE private key bytes are included in string representations and error messages. An attacker can obtain sensitive privat...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the renderobjectstructure process. An attacker can access editorial placeholder and plugin structure metadata of non-authorized objects by sending crafted requests to the structure endpoint as a low-privileged...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the DuplicatePageForm.cleansource bypass in cms/admin/forms.py. The source field in DuplicatePageForm is a hidden field whose value is fully controlled by the client on POST, and its queryset spans every page o...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS in the renderexception process. An attacker can execute arbitrary scripts in the context of a staff user's browser by injecting malicious HTML into plugin fields that are later rendered during edit mode exceptio...

Missing Authorization

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Missing Authorization in the processing of HasMany and MorphMany relationship fields during create and update operations. An...

Improper Handling of Insufficient Permissions or Privileges

Overview wagtail is an open source content management system built on Django. Affected versions of this package are vulnerable to Improper Handling of Insufficient Permissions or Privileges via the PagesAdminAPIViewSet class. An attacker can access sensitive page field contents by sending...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the renderobjectstructure function. An attacker can access sensitive page content by sending requests to the structure endpoint with the content-type id and object id of a view-restricted page. This is only...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through the copyplugins admin endpoint when the source-side authorization is not properly checked. An attacker can access unauthorized plugin content by supplying a sourceplaceholderid or...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the FileUpload process. An attacker can gain unauthorized access to and modify metadata and ordering of attachments belonging to other users by submitting crafted fileid parameters to...

Improper Control of a Resource Through its Lifetime

Overview Affected versions of this package are vulnerable to Improper Control of a Resource Through its Lifetime in the OHttpServerCodec process. An attacker can cause a native direct memory leak by sending encrypted client requests with invalid AEAD tags, leading to resource exhaustion and...

Improper Encoding or Escaping of Output

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the makeCurlRequest function. An attacker can execute arbitrary operating system...

Incomplete Comparison with Missing Factors

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Incomplete Comparison with Missing Factors via the color column rendering process in the Blade template, where the escaped and...

Incorrect Authorization

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Incorrect Authorization in the Update, Delete, and Reorder processes, where query scopes registered via addClause or...

Arbitrary File Upload

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Arbitrary File Upload via the SingleBase64Image::uploadFiles — the uploader bound to image-typed fields via withFiles — only...

Authorization Bypass Through User-Controlled Key

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the uploadMultipleFilesToDisk process. An attacker can delete arbitrary...

Arbitrary File Upload

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Arbitrary File Upload via the HasUploadFields process. An attacker can execute arbitrary code on the server by uploading a file...

Unverified Password Change

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Unverified Password Change in the postAccountInfoForm process. An attacker can gain unauthorized access to another user's accou...

Unverified Password Change

Overview backpack/crud is a package that helps you build an admin interface for your Eloquent models, using Laravel 5 Affected versions of this package are vulnerable to Unverified Password Change via the postAccountInfoForm process. An attacker can gain persistent unauthorized access to user...

Malicious Package

Overview exam-kit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview @pabloclueless/sniffr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @pabloclueless/printr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Uncaught Exception

Overview asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Uncaught Exception via the eval process. An attacker can terminate the application process or disrupt signal and cleanup handlers by supplying specially...

Improper Control of Dynamically-Managed Code Resources

Overview asteval is a Safe, minimalistic evaluator of python expression using ast module Affected versions of this package are vulnerable to Improper Control of Dynamically-Managed Code Resources through the Interpreter process when evaluating attacker-controlled expressions with numpy enabled. A...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking through the bridgeSpan baggage handling in bridge/opentracing/bridge.go. An attacker can crash the process by causing one goroutine to call Span.SetBaggageItem while another goroutine propagates correlation baggage from...

Improper Locking

Overview Affected versions of this package are vulnerable to Improper Locking through the bridgeSpan baggage handling in bridge/opentracing/bridge.go. An attacker can crash the process by causing one goroutine to call Span.SetBaggageItem while another goroutine propagates correlation baggage from...

Malicious Package

Overview ethereum-validator is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview goldstar-api-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview devplatform-api-clients is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview bigops-watchdog-angular is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

Malicious Package

Overview pfp-forms-sme-sitebuilder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview bigops-umf-statist is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview pfp-forms-insurance-health is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

Malicious Package

Overview pfp-forms-independent-sme-glossary-anchor is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...

Malicious Package

Overview pfp-block-mobile-steps is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...

Malicious Package

Overview pfa-errors is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview optimize-regex is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview create-react-app-ux is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview create-react-app-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview rallycoding is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview create-react-app-text is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview o3forms is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...