Archive
1 September 2020
Vulnerabilities first published on this day (UTC), newest first.
192 results · Feed
-
High 8.8
Cross-Site Request Forgery in MAGMI
Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
-
Critical 9.8
Authentication bypass in MAGMI
MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections…
-
Critical —
Malicious Package in s3asy
Version 0.4.8 of `s3asy` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.4.8 of …
-
Critical —
Malicious Package in react-server-native
Version 0.0.7 of `react-server-native` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If ver…
-
Critical —
Malicious Package in react-dates-sc
Version 0.3.0 of `react-dates-sc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version …
-
Critical —
Malicious Package in rc-calendar-jhorst
Version 8.4.3 of `rc-calendar-jhorst` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If vers…
-
Critical —
Malicious Package in oauth-validator
Version 1.0.2 of `oauth-validator` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version…
-
Critical —
Malicious Package in modlibrary
Version 0.1.1 of `modlibrary` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.1.…
-
Critical 9.8
Malicious Package in json-serializer
Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If versio…
-
Unscored —
A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets…
-
Critical —
Malicious Package in jasmin
Version 0.0.3 of `jasmin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.3 of…
-
Unscored —
A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so …
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable w…
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable w…
-
Unscored —
USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view.
-
Unscored —
USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature.
-
Critical 9.9
A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email par…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email par…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email par…
-
Critical 9.8
Malicious Package in freshdom
Version 0.0.6 of `freshdom` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.6 …
-
Critical 9.8
Malicious Package in impala
Version 1.1.7 of `impala` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.1.7 of…
-
Critical 9.8
Malicious Package in dossier
Version 0.0.4 of `dossier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.4 o…
-
Critical 9.8
Malicious Package in dynamo-schema
Version 0.0.3 of `dynamo-schema` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0…
-
Critical —
Malicious Package in css_transform_step
Version 1.0.6 of `css_transform_step` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If vers…
-
Critical —
Malicious Package in css_transform_support
Version 1.0.2 of `css_transform_support` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If v…
-
Critical 9.8
Malicious Package in cordova-plugin-china-picker
Version 1.0.910 of `cordova-plugin-china-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendat…
-
Critical —
Malicious Package in coffee-project
Version 1.7.5 of `coffee-project` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version …
-
Critical 9.8
Malicious Package in codify
Version 0.3.1 of `codify` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.3.1 of…
-
Critical 9.8
Malicious Package in blingjs
Version 0.0.4 of `blingjs` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.4 o…
-
Critical 9.8
Malicious Package in awesome_react_utility
Version 1.0.2 of `awesome_react_utility` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If v…
-
Critical 9.8
Malicious Package in another-date-range-picker
Version 4.1.48 of `another-date-range-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation…
-
Critical 9.8
Malicious Package in another-date-picker
Version 2.0.43 of `another-date-picker` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If ve…
-
Critical 9.8
Malicious Package in angular-material-sidenav-rnd
Version 0.1.1 of `angular-material-sidenav-rnd` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendati…
-
Critical 9.8
Malicious Package in angular-bmap
Version 0.0.9 of `angular-bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.…
-
Critical 9.8
Malicious Package in @impala/bmap
Version 1.0.3 of `@impala/bmap` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.…
-
Medium —
Remote Memory Exposure in openwhisk
Versions of `openwhisk` before 3.3.1 are vulnerable to remote memory exposure. When a number is passed to `api_key`, affected versions of `openwhisk` allocate an uninitialized buffer and send that over network in Authorization header (base64-encoded). Proof o…
-
Medium 5.1
Remote Memory Exposure in mongoose
Versions of `mongoose` before 4.3.6, 3.8.39 are vulnerable to remote memory exposure. Trying to save a number to a field of type Buffer on the affected mongoose versions allocates a chunk of uninitialized memory and stores it in the database. ## Recommendatio…
-
High —
Byass due to validation before canonicalization in serve
Versions of `serve` before 6.5.2 are vulnerable to the bypass of the ignore functionality. The bypass is possible because validation happens before canonicalization of paths and filenames. Example: Here we have a server that ignores the file test.txt. ``` con…