Archive
2 September 2020
Vulnerabilities first published on this day (UTC), newest first.
134 results · Feed
-
Critical 9.8
Malicious Package in font-scrubber
Version 1.2.2 of `font-scrubber` contains malicious code as a postinstall script. The package attempts to upload sensitive files from the system to a remote server. The files include configuration files, command history logs, SSH keys and /etc/passwd. ## Reco…
-
Medium 5.9
Denial of Service in ipfs-bitswap
Versions of `ipfs-bitswap` prior to 0.24.1 are vulnerable to Denial of Service (DoS). The package put unwanted blocks in the blockstore, which could be used to exhaust system resources in specific conditions. ## Recommendation Upgrade to version 0.24.1 or lat…
-
Low —
Sensitive Data Exposure in loopback
Versions of `loopback` prior to 3.26.0 (3.x) and 2.42.0 (2.x) are vulnerable to Sensitive Data Exposure. Invalid API requests to the login endpoint may return information about the first user in the database. This can be used alongside other attacks for crede…
-
Critical —
Malicious Package in kraken-api
Version 0.1.8 of `kraken-api` contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands. ## Recommendation Any computer that has this package installed or running shou…
-
Critical 9.8
Malicious Package in rimrafall
Version 1.0.0 of `rimrafall` contains malicious code as a preinstall script. The package attempts to remove all files in the system's root folder. ## Recommendation If you installed this package it is likely your machine was erased. If not, remove the package…
-
Critical 9.8
Malicious Package in yeoman-genrator
Version 3.1.1 of `yeoman-genrator` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a rem…
-
Critical 9.8
Malicious Package in uglyfi-js
Version 3.4.6 of `uglyfi-js` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote se…
-
Critical 9.8
Malicious Package in tensorplow
All versions of `tensorplow` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands. ## Recommendation Any computer that has this package installed or running should …
-
Critical 9.8
Malicious Package in require-ports
Version 10.4.0 of `require-ports` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remo…
-
Critical 9.8
Malicious Package in logsymbles
Version 2.2.0 of `logsymbles` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote s…
-
Critical 9.8
Malicious Package in jquerz
Version 1.0.1 of `jquerz` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote serve…
-
Critical 9.8
Malicious Package in jqeury
Version 3.3.1 of `jqeury` contains malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote serve…
-
Critical 9.8
Malicious Package in hulp
All versions of `hulp` contain malicious code as a preinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands. ## Recommendation Any computer that has this package installed or running should be con…
-
Critical 9.8
Malicious Package in froever
All versions of `froever` contain malicious code as a preinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed, the package downloads a file from a remote server…
-
Critical 9.8
Malicious Package in colour-string
Version 1.5.3 of `colour-string` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be consid…
-
Critical 9.8
Malicious Package in colro-name
Version 9.0.0 of `colro-name` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be considere…
-
Critical 9.8
Malicious Package in browserift
Version 16.3.3 of `browserift` contained malicious code as a preinstall script. The package was a backdoor that opened a connection to a remote server and executed incoming commands on both Unix and Windows machines ## Recommendation Any computer that has thi…
-
Critical 9.8
Malicious Package in bowe
Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be considered ful…
-
Critical 9.8
Malicious Package in whiteproject
All versions of `whiteproject` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remove the …
-
Critical 9.8
Malicious Package in bowee
Version 1.8.4 of `bowee` contained malicious code as a preinstall script. The package downloaded a file from a remote server, executed it and opened a backdoor. ## Recommendation Any computer that has this package installed or running should be considered ful…
-
Critical 9.8
Malicious Package in saync
All versions of `saync ` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in reqest
All versions of `reqest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
High —
ag-grid Cross-Site Scripting vulnerability
Versions of `ag-grid` prior to 14.0.0 are vulnerable to Cross-Site Scripting (XSS). Grid contents are not properly sanitized and may allow attackers to execute arbitrary JavaScript if user input is rendered in the grid. ## Recommendation Upgrade to version 14…
-
Critical 9.8
Malicious Package in destroyer-of-worlds
The package `destroyer-of-worlds` contained malicious code. The package contained a bash script that was run as a postinstall script. The script deleted system files and attempted to exhaust resources by creating a large file, a fork bomb and an endless loop.…
-
Medium —
Sandbox Breakout / Arbitrary Code Execution in value-censorship
All versions of `value-censorship` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to validate async function constructors allowing attackers to execute arbitrary code. ## Recommendation No fix is currently available. Cons…
-
Critical 9.8
Malicious Package in donotinstallthis
The package `donotinstallthis` contained malicious code. The package contained a script that was run as part of the install script. The script contacted a remote service tracking how many installations were done. There is no further compromise. ## Recommendat…
-
High —
Cross-Site Scripting in fomantic-ui
Versions of `fomantic-ui` are vulnerable to Cross-Site Scripting. Lack of output encoding on the selection dropdowns can lead to user input being executed instead of printed as text. ## Recommendation Upgrade to version 2.7.0 or later.
-
High —
Cross-Site Scripting in jquery-mobile
All version of `jquery-mobile` are vulnerable to Cross-Site Scripting. The package checks for content in `location.hash` and if a URL is found it does an XmlHttpRequest (XHR) to the URL and renders the response with `innerHTML`. It fails to validate the `Cont…
-
Medium —
Cross-Site Scripting in google-closure-library
Versions of `google-closure-library` prior to 20190301.0.0 are vulnerable to Cross-Site Scripting. The `safedomtreeprocessor.processToString()` function improperly processed empty elements, which could allow attackers to execute arbitrary JavaScript through M…
-
High —
Cross-Site Scripting in wangeditor
All versions of `wangeditor` are vulnerable to Cross-Site Scripting. The package fails to properly encode output, allowing arbitrary JavaScript to be inserted in links and executed by browsers. ## Recommendation No fix is currently available. Consider using a…
-
Critical 9.8
Malicious Package in carloprojectdiscord
All versions of `carloprojectdiscord` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remo…
-
Critical 9.8
Malicious Package in discord_debug_log
All versions of `discord_debug_log` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remove…
-
Critical 9.8
Malicious Package in carloprojectlesang
All versions of `carloprojectlesang` contain obfuscated malware that uploads Discord user tokens to a remote server. This allows attackers to make purchases on behalf of users if they have credit cards linked to their Discord accounts. ## Recommendation Remov…
-
Critical 9.8
Malicious Package in erquest
All versions of `erquest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in rqeuest
All versions of `rqeuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in requset
All versions of `requset` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Critical 9.8
Malicious Package in requets
All versions of `requets` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, th…
-
Medium 6.8
Dell Inspiron 7352 BIOS versions prior to A12 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attack…
-
High 8.1
Dell EMC ECS, versions prior to 3.5, contains an Exposure of Resource vulnerability. A remote unauthenticated attacker …
-
Medium 6.8
Dell Inspiron 7347 BIOS versions prior to A13 contain a UEFI BIOS Boot Services overwrite vulnerability. A local attack…