Archive
1 September 2020
Vulnerabilities first published on this day (UTC), newest first.
192 results · Feed
-
Unscored —CVE-2020-24955 Public exploit
SUPERAntiSyware Professional X Trial 10.0.1206 is vulnerable to local privilege escalation because it allows unprivileg…
-
Medium 6.1
The BIOS tamper detection mechanism was not triggered in Lenovo ThinkPad A285, BIOS versions up to r0xuj70w; A485, BIOS…
-
Unscored —
In Lenovo systems, SMM BIOS Write Protection is used to prevent writes to SPI Flash. While this provides sufficient pro…
-
High 7.5
Denial of Service in markdown-it-toc-and-anchor
All versions of `markdown-it-toc-and-anchor` are vulnerable to Denial of Service. Parsing markdown containing `**text**+\n@[toc]` causes the application to enter and infinite loop. ## Recommendation No fix is currently available. Consider using an alternative…
-
High —
Cross-Site Scripting in jingo
Versions of `jingo` prior to 1.9.2 are vulnerable to Cross-Site Scripting (XSS). If malicious input such as `<script>alert(1)</script>` is placed in the content of a wiki page, Jingo does not properly encode the input and it is executed instead of rendered as…
-
High —
Cross-Site Scripting in md-data-table
All versions of `md-data-table` are vulnerable to cross-site scripting (XSS). This vulnerability is exploitable if an attacker has control over data that is rendered by `mdt-row` ## Recommendation As there is no fix for this vulnerability at this time we reco…
-
High —
Cross-Site Scripting in buefy
Versions of buefy prior to 0.7.2 are vulnerable to Cross-Site Scripting, allowing attackers to manipulate the DOM and execute remote code. The autocomplete list renders user input as HTML without encoding. ## Recommendation Upgrade to version 0.7.2 or later.
-
Critical 9.8
Entropy Backdoor in text-qrcode
All versions of `text-qrcode` contain malicious code that overwrites the `randomBytes` method for the `crypto` module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and ha…
-
Critical 9.8
Malicious Package in flatmap-stream
Version 0.1.1 of `flatmap-stream` is considered malicious. This module runs an encrypted payload targeting a very specific application, `copay` and because they shared the same description it would have likely worked for `copay-dash`. The injected code: - Rea…
-
Critical —
Command Injection in samsung-remote
Versions of `samsung-remote` before 1.3.5 are vulnerable to command injection. This vulnerability is exploitable if user input is passed into the `ip` option of the package constructor. ## Recommendation Update to version 1.3.5 or later.
-
Low —
Command Injection in ascii-art
Versions of `ascii-art` before 1.4.4 are vulnerable to command injection. This is exploitable when user input is passed into the argument of the `ascii-art preview` command. Example Proof of concept: `ascii-art preview 'doom"; touch /tmp/malicious; echo "'` G…
-
High —
NoSQL injection in express-cart
Versions of `express-cart` before 1.1.8 are vulnerable to NoSQL injection. The vulnerability is caused by the lack of user input sanitization in the login handlers. In both cases, the customer login and the admin login, parameters from the JSON body are sent …
-
Low —
Prototype Pollution in merge-objects
All versions of `merge-objects` are vulnerable to Prototype Pollution. ## Recommendation No fix is available for this vulnerability at this time. It is our recommendation to use an alternative package.
-
Critical 9.8
Malicious Package in foever
All versions of `foever` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitr…
-
Critical 9.8
Malicious Package in soket.js
All versions of `soket.js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbi…
-
Critical 9.8
Malicious Package in soket.io
All versions of `soket.io` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbi…
-
Critical 9.8
Malicious Package in regenraotr
All versions of `regenraotr` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute ar…
-
Critical 9.8
Malicious Package in regenrator
All versions of `regenrator` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute ar…
-
Critical 9.8
Malicious Package in axois
All versions of `axois` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitra…
-
Low —
Out-of-bounds Read in njwt
Versions of `njwt` prior to 1.0.0 are vulnerable to out-of-bounds reads when a number is passed into the `base64urlEncode` function. On Node.js 6.x or lower this can expose sensitive information and on any other version of Node.js this creates a Denial of Ser…
-
Critical 9.8
Malicious Package in boogeyman
All versions of `boogeyman` are considered malicious. This particular package would download a payload from pastebin.com, eval it to read ssh keys and the users `.npmrc` and send them to a private pastebin account. ## Recommendation This package was published…
-
High —
Path Traversal in express-cart
Versions of `express-cart` before 1.1.7 are vulnerable to Path Traversal. ## Recommendation Update to version 1.1.7 or later.
-
Critical 9.8
A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A sp…
-
High 8.1
A memory corruption vulnerability exists in the TIFF handle_COMPRESSION_PACKBITS functionality of Accusoft ImageGear 19…
-
Medium 5.9
Man-in-the-middle attack in Apache Cassandra
In Apache Cassandra, all versions prior to 2.1.22, 2.2.18, 3.0.22, 3.11.8 and 4.0-beta2, it is possible for a local attacker without access to the Apache Cassandra process or configuration files to manipulate the RMI registry to perform a man-in-the-middle at…
-
Critical 9.8
Malicious Package in eslint-config-airbnb-standard
Version 2.0.0 of `eslint-config-airbnb-standard` was published with a bundled version of `eslint-scope` that was found to contain malicious code. This code would read the users `.npmrc` file and send it's contents to a remote server. ## Recommendation The bes…
-
Unscored —
The affected product is vulnerable due to an undocumented interface found on the device, which may allow an attacker to…
-
Critical —
Malicious Package in eslint-config-eslint
Version 5.0.2 of `eslint-config-eslint` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to a remote server. ## Recommendation The best course of…
-
Unscored —
The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute a…
-
High —
Cross-Site Scripting in react-marked-markdown
All versions of `react-marked-markdown` are vulnerable to cross-site scripting (XSS) via `href` attributes. This is exploitable if user is provided to `react-marked-markdown` Proof of concept: ``` import React from 'react' import ReactDOM from 'react-dom' imp…
-
Medium —
Out-of-bounds Read in base64url
Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below. ## Recommendation Update to version 3.0.0 or later.
-
Unscored —
The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different confi…
-
Critical 9.8
Malicious Package in ladder-text-js
`ladder-text-js` contained a malicious script that attempted to delete all files when `npm test` was run. ## Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
-
Critical 9.8
Malicious Package in nothing-js
`nothing-js` contained a malicious script that attempted to delete all files when `npm test` was run. ## Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
-
Unscored —
The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbi…
-
Critical 9.8
Malicious Package in getcookies
The `getcookies` module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module. ## Recommendation This module should be uninstalled if found used within an application. In addition …
-
Critical —
Malicious Package in dictum.js
Version 1.0.5 of `dictum.js` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.0.5…
-
Critical 9.8
Malicious Package in nginxbeautifier
Version 1.0.14 of `nginxbeautifier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If versio…
-
Critical —
Malicious Package in xoc
Version 1.0.7 of `xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.0.7 of th…
-
Critical —
Malicious Package in simple-alipay
Version 1.0.1 of `simple-alipay` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1…