Malicious Package

Overview epic-sso is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview epic-common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Malicious Package

Overview epic-common-node is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @ai-vertical/ai-agent is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Weak Password Recovery Mechanism for Forgotten Password

Overview org.keycloak:keycloak-services is an open source identity and access management solution for modern applications and services. Affected versions of this package are vulnerable to Weak Password Recovery Mechanism for Forgotten Password in the ResetCredentialEmail.action flow in...

Malicious Package

Overview kb-ai is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious Package

Overview orakw is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview ise18n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview ioe18n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview joxn is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector T...

Malicious Package

Overview iai8n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview agentgui is a malicious package. This package has been compromised as part of a malicious supply-chain attack linked to North Korean threat actors Contagious Interview campaign / Lazarus APT group. The legitimate package was hijacked, with intact functionality maintained to evade early...

Malicious Package

Overview i1l8n is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview ubnuler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vecto...

Malicious Package

Overview i18om is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview brumdler is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vect...

Malicious Package

Overview ubnlder is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vecto...

Malicious Package

Overview ri18nr is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview ie18u is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview reaker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview rakier is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview activesupmport is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attac...

Allocation of Resources Without Limits or Throttling

Overview Scriban is a Scriban is a fast, powerful, safe and lightweight scripting language and engine for .NET, which was primarily developed for text templating with a compatibility mode for parsing liquid templates. Today, not only Scriban can be used in text templating scenarios, but also can ...

Improper Encoding or Escaping of Output

Overview shescape is a simple shell escape library Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via the getEscapeFunction logic in src/internal/unix/busybox.js. An attacker can reveal the user's home directory and alter how a command interprets an...

Brute Force

Overview Affected versions of this package are vulnerable to Brute Force via the requestHandler in app/vmauth/main.go. An attacker can brute-force authentication by sending large numbers of unauthorized requests because failed logins are returned immediately. This lets a remote attacker sustain...

Insufficient Entropy

Overview dtale is a Web Client for Visualizing Pandas Objects Affected versions of this package are vulnerable to Insufficient Entropy due to the buildsecretkey function in dtale/app.py generating insufficiently random values for session cookies. An attacker can predict session cookie values by...

Cross-site Request Forgery (CSRF)

Overview @fastify/oauth2 is a Perform login using oauth2 protocol Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to the OAuth state-check cookies in the index.js authorization flow. An attacker can log a victim into the attacker’s account by planting...

Incomplete Cleanup

Overview @fastify/multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Incomplete Cleanup due to incomplete temporary-file handling in saveRequestFiles in index.js. An attacker can exhaust disk space by sending a multipart request that completes one file...

Incomplete Cleanup

Overview @fastify/multipart is a Multipart plugin for Fastify Affected versions of this package are vulnerable to Incomplete Cleanup due to the saveRequestFiles multipart upload handling in index.js. An attacker can hang a request and leave temporary files behind by sending a file part that excee...

Brute Force

Overview dtale is a Web Client for Visualizing Pandas Objects Affected versions of this package are vulnerable to Brute Force via the login function in auth.py of the Login Endpoint. An attacker can gain unauthorized access by performing excessive authentication attempts without proper restrictio...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the endpoint that collects Content Security Policy violation reports. An attacker can cause excessive memory consumption and disrupt service availability by submitting a large,...

Allocation of Resources Without Limits or Throttling

Overview org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the endpoint that collects Content Security...

Allocation of Resources Without Limits or Throttling

Overview org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the handling of the localized-text cache. An...

Unsynchronized Access to Shared Data in a Multithreaded Context

Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context in the JSON plugin due to shared parsing state across concurrent requests. An attacker can access data associated with another user's request or bypass configured parsing...

Unsynchronized Access to Shared Data in a Multithreaded Context

Overview Affected versions of this package are vulnerable to Unsynchronized Access to Shared Data in a Multithreaded Context in the JSON plugin's SMD/JSON-RPC handling. An attacker can access response content intended for another user's session by making concurrent requests, potentially exposing...

Replay Attack

Overview Affected versions of this package are vulnerable to Replay Attack through the getUserByOIDCToken process in FacebookProvider.php. An attacker can impersonate a victim account by replaying a captured, valid Facebook OIDC idtoken to userFromToken without providing a matching session nonce...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the csinsnname lookup in arch/M68K/M68KInstPrinter.c and arch/RISCV/RISCVMapping.c. An attacker can crash the process by supplying an invalid instruction ID to csinsnname on an M68K or RISCV handle. On M68K, the...

Numeric Truncation Error

Overview Affected versions of this package are vulnerable to Numeric Truncation Error in readbrtable in arch/WASM/WASMDisassembler.c. An attacker can cause no-progress disassembly or parser desynchronization by supplying a large, well-formed brtable instruction through csdisasm or csdisasmiter. T...

Sensitive Cookie with Improper SameSite Attribute

Overview Affected versions of this package are vulnerable to Sensitive Cookie with Improper SameSite Attribute through the server default configuration and OAuth2/OIDC consent flow in serverdefaults.properties, ConsentRequiredResource, and CsrfProtection. An attacker can steal or abuse an...

Directory Traversal

Overview ch.qos.logback:logback-classic is a reliable, generic, fast and flexible logging library for Java. Affected versions of this package are vulnerable to Directory Traversal in MDCBasedDiscriminator, used by SiftingAppender, which takes an MDC value as the discriminating key without removin...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the JSON plugin when handling JSON request bodies. An attacker can cause excessive memory consumption by sending a large JSON payload, potentially leading to service disruption for...

Allocation of Resources Without Limits or Throttling

Overview org.apache.struts:struts2-core is a popular open-source framework for developing web applications in the Java programming language. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the JSON plugin when handling JSON request bodie...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext-vscode is a Theia - Plugin Extension for VsCode Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute...

Inclusion of Functionality from Untrusted Control Sphere

Overview @theia/plugin-ext is a Theia - Plugin Extension Affected versions of this package are vulnerable to Inclusion of Functionality from Untrusted Control Sphere due to missing workspace-trust enforcement in the plugin and extension loading path. An attacker can execute commands with the user...

Arbitrary Code Injection

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Arbitrary Code Injection in the settings validation process of the Flex Objects plugin via uploading a ZIP archive containing PHP code. An...

Directory Traversal

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Directory Traversal via the backup profile configuration process. An attacker can access sensitive files outside the intended directory by...

Improper Neutralization of Special Elements Used in a Template Engine

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Improper Neutralization of Special Elements Used in a Template Engine via the find filter in email-action parameters such as subject, body, to...

Incorrect Authorization

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Incorrect Authorization in the FlexApiController::update process. An attacker can gain full administrative control by exploiting insufficient...

Cross-site Scripting (XSS)

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Cross-site Scripting XSS in the detectXss function. An attacker can execute arbitrary JavaScript in the context of site visitors by injecting...

Denial of Service (DoS)

Overview std/crypto/tls is a Go standard library package std/crypto/tls Affected versions of this package are vulnerable to Denial of Service DoS. Go Vulnerability Report:Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been...