Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Unscored —
Huawei smartphones HONOR 20 PRO Versions earlier than 10.1.0.230(C432E9R5P1),Versions earlier than 10.1.0.231(C10E3R3P2…
-
Critical 9.8
Malicious Package in tiar
All versions of `tiar` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All s…
-
Unscored —
A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to exec…
-
Unscored —
B2368-22 V100R001C00;B2368-57 V100R001C00;B2368-66 V100R001C00 have a command injection vulnerability. An attacker with…
-
Unscored —
A use after free was found in igc_reloc_struct_ptr() of psi/igc.c of ghostscript-9.25. A local attacker could supply a …
-
Unscored —
A flaw was found in the Linux kernel's implementation of GRO in versions before 5.2. This flaw allows an attacker with …
-
Unscored —
GnuPG 2.2.21 and 2.2.22 (and Gpg4win 3.1.12) has an array overflow, leading to a crash or possibly unspecified other im…
-
Critical 9.8
Malicious Package in secure_identity_login_module
All versions of `secure_identity_login_module` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered …
-
Critical 9.8
Malicious Package in river-mock
All versions of `river-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…
-
Critical 9.8
Malicious Package in retcodelog
All versions of `retcodelog` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…
-
Critical 9.8
Malicious Package in qingting
All versions of `qingting` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. A…
-
Critical 9.8
Malicious Package in node-buc
All versions of `node-buc` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. A…
-
Critical 9.8
Malicious Package in midway-dataproxy
All versions of `midway-dataproxy` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compro…
-
Critical 9.8
Malicious Package in midway-xtpl
All versions of `midway-xtpl` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised…
-
Critical 9.8
Malicious Package in hsf-clients
All versions of `hsf-clients` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised…
-
Critical 9.8
Malicious Package in luna-mock
All versions of `luna-mock` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. …
-
Critical 9.8
Malicious Package in hpmm
All versions of `hpmm` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All s…
-
Critical 9.8
Malicious Package in cicada-render
All versions of `cicada-render` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromis…
-
Critical 9.8
Malicious Package in diamond-clien
All versions of `diamond-clien` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromis…
-
Critical 9.8
Malicious Package in appx-compiler
All versions of `appx-compiler` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromis…
-
Critical 9.8
Malicious Package in antd-cloud
All versions of `antd-cloud` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised.…
-
Critical 9.8
Malicious Package in alipayjsapi
All versions of `alipayjsapi` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised…
-
Critical 9.8
Malicious Package in alico
All versions of `alico` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All …
-
Critical 9.8
Malicious Package in ali-contributors
All versions of `ali-contributors` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully compro…
-
Critical 9.8
Malicious Package in ali-contributor
All versions of `ali-contributor` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it. ## Recommendation Any computer that has this package installed or running should be considered fully comprom…
-
Critical 9.8
Malicious Package in only-test-not-install
All versions of `only-test-not-install` contain malicious code. The package deletes the folder `~/test` from the system as a postinstall script. ## Recommendation Remove the package from your environment. There are no further signs of compromise.
-
Critical 9.8
Malicious Package in my-very-own-package
All versions of `my-very-own-package` contain malicious code. The package sends the output of `process.versions`, `process.arch` and `process.platform` to a remote server in a postinstall script. ## Recommendation Remove the package from your environment. The…
-
Critical 9.8
Malicious Package in maybemaliciouspackage
All versions of `maybemaliciouspackage` contain malicious code. The package prints the system's SSH keys to the console as a postinstall script. ## Recommendation Remove the package from your environment. There are no further signs of compromise.
-
Critical 9.8
Malicious Package in leetlog
Versions 0.1.2 and 0.1.3 of `leetlog` contain malicious code. The package adds an arbitrary hardcoded SSH key identified as `hacker@evilmachine` to the system's `authorized_keys` ## Recommendation Any computer that has this package installed or running should…
-
Unscored —
The Admin CP in vBulletin 5.6.3 allows XSS via an Occupation Title or Description to User Profile Field Manager.
-
Unscored —
The Admin CP in vBulletin 5.6.3 allows XSS via an Announcement Title to Channel Manager.
-
Critical 9.8
Malicious Package in malicious-do-not-install
All versions of `malicious-do-not-install` contain malicious code. The package copies the contents of `/etc/passwd` and `/etc/shadow` to files in the local `/tmp/` folder. ## Recommendation Remove the package from your environment and rotate affected credenti…
-
Unscored —
The Admin CP in vBulletin 5.6.3 allows XSS via a Junior Member Title to User Title Manager.
-
Unscored —
The Admin CP in vBulletin 5.6.3 allows XSS via a Style Options Settings Title to Styles Manager.
-
Unscored —
The Admin CP in vBulletin 5.6.3 allows XSS via a Title of a Child Help Item in the Login/Logoff part of the User Manual.
-
Unscored —
The Admin CP in vBulletin 5.6.3 allows XSS via the admincp/search.php?do=dosearch URI.
-
Unscored —
The Admin CP in vBulletin 5.6.3 allows XSS via the Paid Subscription Email Notification field in the Options.
-
Medium 6.5
Reverse Tabnabbing in quill
Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening l…
-
Unscored —
The Admin CP in vBulletin 5.6.3 allows XSS via a Rank Type to User Rank Manager.
-
Unscored —
The Admin CP in vBulletin 5.6.3 allows XSS via a Smilie Title to Smilies Manager.