Archive
1 September 2020
Vulnerabilities first published on this day (UTC), newest first.
75 results · Clear filters · Feed
-
Critical 9.8
Entropy Backdoor in text-qrcode
All versions of `text-qrcode` contain malicious code that overwrites the `randomBytes` method for the `crypto` module with a function that generates weak entropy. Instead of generating 32 bytes, the infected randomBytes will generate 3 bytes of entropy and ha…
-
Critical 9.8
Malicious Package in flatmap-stream
Version 0.1.1 of `flatmap-stream` is considered malicious. This module runs an encrypted payload targeting a very specific application, `copay` and because they shared the same description it would have likely worked for `copay-dash`. The injected code: - Rea…
-
Critical —
Command Injection in samsung-remote
Versions of `samsung-remote` before 1.3.5 are vulnerable to command injection. This vulnerability is exploitable if user input is passed into the `ip` option of the package constructor. ## Recommendation Update to version 1.3.5 or later.
-
Critical 9.8
Malicious Package in foever
All versions of `foever` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitr…
-
Critical 9.8
Malicious Package in soket.js
All versions of `soket.js` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbi…
-
Critical 9.8
Malicious Package in soket.io
All versions of `soket.io` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbi…
-
Critical 9.8
Malicious Package in regenraotr
All versions of `regenraotr` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute ar…
-
Critical 9.8
Malicious Package in regenrator
All versions of `regenrator` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute ar…
-
Critical 9.8
Malicious Package in axois
All versions of `axois` are considered malicious. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When executed, the package calls home to a Command and Control server to execute arbitra…
-
Critical 9.8
Malicious Package in boogeyman
All versions of `boogeyman` are considered malicious. This particular package would download a payload from pastebin.com, eval it to read ssh keys and the users `.npmrc` and send them to a private pastebin account. ## Recommendation This package was published…
-
Critical 9.8
A code execution vulnerability exists in the DICOM parse_dicom_meta_info functionality of Accusoft ImageGear 19.7. A sp…
-
Critical 9.8
Malicious Package in eslint-config-airbnb-standard
Version 2.0.0 of `eslint-config-airbnb-standard` was published with a bundled version of `eslint-scope` that was found to contain malicious code. This code would read the users `.npmrc` file and send it's contents to a remote server. ## Recommendation The bes…
-
Critical —
Malicious Package in eslint-config-eslint
Version 5.0.2 of `eslint-config-eslint` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to a remote server. ## Recommendation The best course of…
-
Critical 9.8
Malicious Package in ladder-text-js
`ladder-text-js` contained a malicious script that attempted to delete all files when `npm test` was run. ## Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
-
Critical 9.8
Malicious Package in nothing-js
`nothing-js` contained a malicious script that attempted to delete all files when `npm test` was run. ## Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
-
Critical 9.8
Malicious Package in getcookies
The `getcookies` module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module. ## Recommendation This module should be uninstalled if found used within an application. In addition …
-
Critical —
Malicious Package in dictum.js
Version 1.0.5 of `dictum.js` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.0.5…
-
Critical 9.8
Malicious Package in nginxbeautifier
Version 1.0.14 of `nginxbeautifier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If versio…
-
Critical —
Malicious Package in xoc
Version 1.0.7 of `xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.0.7 of th…
-
Critical —
Malicious Package in simple-alipay
Version 1.0.1 of `simple-alipay` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1…
-
Critical 9.8
Authentication bypass in MAGMI
MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections…
-
Critical —
Malicious Package in s3asy
Version 0.4.8 of `s3asy` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.4.8 of …
-
Critical —
Malicious Package in react-server-native
Version 0.0.7 of `react-server-native` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If ver…
-
Critical —
Malicious Package in react-dates-sc
Version 0.3.0 of `react-dates-sc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version …
-
Critical —
Malicious Package in rc-calendar-jhorst
Version 8.4.3 of `rc-calendar-jhorst` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If vers…
-
Critical —
Malicious Package in oauth-validator
Version 1.0.2 of `oauth-validator` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version…
-
Critical —
Malicious Package in modlibrary
Version 0.1.1 of `modlibrary` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.1.…
-
Critical 9.8
Malicious Package in json-serializer
Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If versio…
-
Critical —
Malicious Package in jasmin
Version 0.0.3 of `jasmin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.3 of…
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable w…
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable w…
-
Critical 9.9
A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email par…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email par…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email par…
-
Critical 9.8
Malicious Package in freshdom
Version 0.0.6 of `freshdom` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.6 …
-
Critical 9.8
Malicious Package in impala
Version 1.1.7 of `impala` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.1.7 of…
-
Critical 9.8
Malicious Package in dossier
Version 0.0.4 of `dossier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.4 o…
-
Critical 9.8
Malicious Package in dynamo-schema
Version 0.0.3 of `dynamo-schema` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0…