Malicious Package

Overview -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...

Malicious Package

Overview -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, the...

Malicious Package

Overview -john-wick-4-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...

Malicious Package

Overview -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-suparhit is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...

Malicious Package

Overview -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is n...

Malicious Package

Overview -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-index-main is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...

Malicious Package

Overview -john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection betwe...

Malicious Package

Overview -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena- is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there ...

Malicious Package

Overview -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena-espanol is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...

Malicious Package

Overview -whare-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-123 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...

Malicious Package

Overview -john-wick-4-keanu-reeves-peliculas-completa-h-d-varindo-en-casa-lliena-espanol is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there i...

Malicious Package

Overview -john-wick-4-keanu-reeves-pelicula-completa-h-d-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...

Malicious Package

Overview -john-wick-keanu-reeves-pelicula-completa-4-k-varindo-en-casa-en-lienia-lliena- is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there i...

Malicious Package

Overview -john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-tarabi-lliena- is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization,...

Malicious Package

Overview -whareo-to-watch-john-wick-chapter-4-2023-fullmovies-hd-online-at-home is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...

Malicious Package

Overview -pem-misa is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview -espanol-john-wick-keanu-reeves-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no...

Malicious Package

Overview -espanol-john-wick-keanu-4-k-varindo-en-casa-en-lienia-lliena-love is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connecti...

Malicious Package

Overview -accion-pelicula-john-wick-4-keanu-reeves-peliculas-completa-varindo-h-d-varindo-en-casa-lliena- is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid...

Malicious Package

Overview -accion-pelicula-john-wick-4-keanu-reeves-peliculas-completa-varindo-allah-varindo-en-casa-lliena- is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid...

Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication in the authentication process when handling OIDC subject identifiers due to the use of an accent-insensitive collation in the database. An attacker can gain unauthorized access to another user's account by...

Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key through improper validation of ownership in the editRecord process. An attacker can modify or overwrite DNS records in zones they do not own by manipulating the rid and zid parameters in ...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization in the updateUser process of the API endpoint, which fails to enforce proper authorization checks for editing superuser accounts and changing user passwords. An attacker can gain full administrative access by sendi...

Authentication Bypass by Assumed-Immutable Data

Overview Affected versions of this package are vulnerable to Authentication Bypass by Assumed-Immutable Data in the password change process when the stored password remains at its default value and the submitted password is not verified. An attacker can gain unauthorized access and set a new...

Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource in the zlibdecomp function when processing a zlib stream that inflates to fewer bytes than the expected frame size. An attacker can access uninitialized heap memory contents by supplying a crafted zlib...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the pngwritechunk process. An attacker can cause heap memory corruption, process crashes, or potentially achieve arbitrary code execution by supplying a crafted PNG image containing a malicious eXIf chunk...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound in the macedecodeframe process. An attacker can corrupt heap memory and potentially execute arbitrary code by supplying a crafted CAF file with malicious bytesperpacket and framesperpacket values that...

Out-of-bounds Write

Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the vfquirc filter. An attacker can corrupt heap memory and potentially execute arbitrary code by supplying a crafted PGS/SUP subtitle file with mismatched frame dimensions, where the second presentation has large...

Arbitrary Argument Injection

Overview Affected versions of this package are vulnerable to Arbitrary Argument Injection via the terminal process. An attacker can execute arbitrary commands on the host system by supplying crafted arguments to allowlisted binaries, bypassing command restrictions through argument injection. This...

Information Exposure

Overview GitPython is a python library used to interact with Git repositories Affected versions of this package are vulnerable to Information Exposure in the Repo.createremote process when attacker-controlled URLs are passed and environment variables are expanded into the URL. An attacker can...

Server-side Request Forgery (SSRF)

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the REST datasource integration due to improper handling of DNS rebinding protections. An attacker can access...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the REST datasource integration due to improper handling of DNS rebinding protections. An attacker can access internal-only services, read sensitive data, or...

SQL Injection

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to SQL Injection in the json field enrichment process. An attacker can access unauthorized data, execute arbitrary JavaScript on the database server, perform cross-collection queries, or modify and...

Improper Neutralization of Special Elements in Data Query Logic

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify or delete arbitrary documents, an...

Improper Neutralization of Special Elements in Data Query Logic

Overview @budibase/string-templates is a Handlebars wrapper for Budibase templating. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Data Query Logic in the enrichContext process. An attacker can gain unauthorized access to sensitive data, modify...

Server-side Request Forgery (SSRF)

Overview @budibase/backend-core is a Budibase backend core libraries used in server and worker Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by...

Server-side Request Forgery (SSRF)

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the OpenAPI import and REST query execution processes. An attacker can access internal network resources by exploiting DNS rebinding to bypass outbound fetch...

Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure in the handling of the tlsCertificateKeyFile and tlsCAFile fields, which are passed directly as filesystem paths to the MongoDB driver without validation or restriction. An...

Information Exposure

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Information Exposure via the metadata endpoints, which fail to sanitize sensitive fields from user profiles. An attacker can obtain OAuth2 access and refresh tokens belonging to other users by...

Incorrect Authorization

Overview @budibase/server is a Budibase Web Server Affected versions of this package are vulnerable to Incorrect Authorization via the assign process. An attacker can gain unauthorized access to other applications and assign elevated roles to themselves or other users by exploiting insufficient...

Server-side Request Forgery (SSRF)

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the sanitizeproxypath process. An attacker can access unauthorized files or directories by submitting a specially crafted, deeply percent-encoded path parameter that bypass...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization in the generatechatcompletion process. An attacker can gain unauthorized access to restricted underlying models by submitting crafted requests to task endpoints that leverage readable...

Incorrect Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Incorrect Authorization through the meta.knowledge process. An attacker can gain unauthorized write or delete access to files belonging to other users by attaching a file ID, for which they only have read...

User Impersonation

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to User Impersonation via the wsterminal process. An attacker can gain unauthorized access to another user's terminal session by injecting crafted values into the sessionid parameter, causing the backend to...

Protection Mechanism Failure

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Protection Mechanism Failure through improper matching of hostnames in the WEBFETCHFILTERLIST process. An attacker can access hosts that should be blocked or bypass allowlists by crafting URLs with specific...

Heap-based Buffer Overflow

Overview Affected versions of this package are vulnerable to Heap-based Buffer Overflow in the fullpacket function during Encrypt-then-MAC cipher negotiation. An attacker can corrupt heap metadata and potentially achieve arbitrary code execution or cause a denial of service by sending a specially...

Arbitrary Code Injection

Overview microweber/microweber is a new generation CMS with drag and drop. Affected versions of this package are vulnerable to Arbitrary Code Injection via the TwigView::render process. An attacker can execute arbitrary operating system commands by injecting malicious Twig expressions into mail...

Malicious Package

Overview app-data-layer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview app-data-lts is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview app-node-layer is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...