Archive
11 September 2020
Vulnerabilities first published on this day (UTC), newest first.
25 results · Clear filters · Feed
-
Critical —
Malicious Package in radic-util
Version 1.0.2 of `radic-util` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the p…
-
Critical 9.8
Malicious Package in motiv.scss
Version 0.4.20 of `motiv.scss` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the …
-
Critical 9.8
Malicious Package in react-datepicker-plus
Versions 2.4.3 and 2.4.2 of `react-datepicker-plus` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recom…
-
Critical —
Malicious Package in precode.js
Version 1.1.1 of `precode.js` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the p…
-
Critical —
Malicious Package in scroool
Version 0.1.7 of `scroool` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the pack…
-
Critical —
Malicious Package in grunt-radical
Version 0.0.14 of `grunt-radical` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove t…
-
Critical 9.8
Malicious Package in ng-ui-library
Version 1.0.987 of `ng-ui-library` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove …
-
Critical —
Malicious Package in grunt-radic
Version 0.1.1 of `grunt-radic` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the …
-
Critical —
Malicious Package in github-jquery-widgets
Version 0.1.2 of `github-jquery-widgets` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation R…
-
Critical —
Malicious Package in ember-power-timepicker
Version 1.0.8 of `ember-power-timepicker` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation …
-
Critical —
Malicious Package in electron-native-notify
All versions of `electron-native-notify` contain malicious code. The package was part of a targeted attack to steal cryptocurrency wallet seeds and upload them to a remote server, effectively giving attackers access to users wallets. ## Recommendation Remove …
-
Critical 9.8
Malicious Package in test-module-a
All versions of `test-module-a` contain malicious code as a preinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, ## Recommendation Remove th…
-
Critical 9.8
Malicious Package in epress
Version 4.13.2 of `epress` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. ##…
-
Critical —
Malicious Package in geoheat
Version 1.3.2 of `geoheat` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation Remove the pack…
-
Critical 9.8
Malicious Package in commmander
All versions of `commmander` contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. #…
-
Critical 9.8
Malicious Package in blubird
Version 3.5.0 of `blubird` contains malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. ##…
-
Critical —
Malicious Package in angular-location-update
Version 0.0.3 of `angular-location-update` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation…
-
Critical 9.8
Malicious Package in equest
All versions of `equest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in commqnder
All versions of `commqnder` contain malicious code . The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. Upon require the package attempts to start a cryptocurrency miner using coin-hive. ##…
-
Critical 9.8
Malicious Package in reuest
All versions of `reuest` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.8
Malicious Package in angluar-cli
Version 0.0.3 of `angluar-cli` contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and st…
-
Critical 9.8
Malicious Package in shrugging-logging
All versions of `shrugging-logging` contain malicious code as a postinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, ## Recommendation Remo…
-
Critical 9.8
Malicious Package in requst
All versions of `requst` typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the…
-
Critical 9.9
Microsoft SharePoint Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft SharePoint where APIs aren't properly protected from unsafe data input. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the SharePoint application…
-
Critical 9.9
Microsoft SharePoint Remote Code Execution Vulnerability
<p>A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the Share…