Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
High —
Denial of Service in @hapi/subtext
Versions of `@hapi/subtext` prior to 6.1.2 are vulnerable to Denial of Service (DoS). The package fails to enforce the `maxBytes` configuration for payloads with chunked encoding that are written to the file system. This allows attackers to send requests with…
-
High —
Regular Expression Denial of Service in sql-injection
All versions of `sql-injection` are vulnerable to Regular Expression Denial of Service. The package processes a request's body with regular expressions that may take exponentially longer to execute for large inputs. ## Recommendation No fix is currently avail…
-
Critical —
Malicious Package in evil-package
All versions of `evil-package` contain malicious code. The package uploads the contents of `process.env` to `example.com/log`. ## Recommendation Remove the package from your environment. Given the host where the information was uploaded to there is no further…
-
Medium —
Unintended Require in larvitbase-www
All versions of `larvitbase-www` are vulnerable to an Unintended Require. The package exposes an API endpoint and passes a GET parameter unsanitized to an `require()` call. This allows attackers to execute any `.js` file in the same folder as the server is ru…
-
Medium —
Path Traversal in public
All versions of `public` are vulnerable to Path Traversal. This vulnerability allows an attacker to access files outside the webroot since it allows symlink navigation in the URL. ## Recommendation No fix is currently available. Do not use `public` in product…
-
Medium —
Denial of Service in sequelize
Versions of `sequelize` prior to 4.44.4 are vulnerable to Denial of Service (DoS). The SQLite dialect fails to catch a `TypeError` exception for the `results` variable. The `results` value may be undefined and trigger the error on a `.map` call. This may allo…
-
Critical 9.8
Malicious Package in sparkies
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in serilize
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in serializes
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in node-spdy
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in node-ftp
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mysql-koa
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogoose
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogodb-core
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogodb
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in mogobd
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in koa-body-parse
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in k0a_multer
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in js-regular
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in js-base64-int
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in import-mysql
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.8
Malicious Package in file-logging
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in bs85
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bs58chekc
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bsae-x
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in body-parse-xml
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in cionstring
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstirng
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinpayment
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstrng
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in coinstrig
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in colne
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in axioss
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in commandre
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in commanedr
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in conistring
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in crpyto-js
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in axios-http
This package contained malicious code. The package uploaded system information such as OS and hostname to a remote server. ## Recommendation Remove the package from your environment. There are no indications of further compromise.
-
Critical 9.1
Malicious Package in crytpo-js
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical —
Command Injection in marsdb
All versions of `marsdb` are vulnerable to Command Injection. In the `DocumentMatcher` class, selectors on `$where` clauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is ex…