Archive
September 2020
Vulnerabilities first published in this month (UTC), newest first.
2,205 results · Feed
-
Critical —
Malicious Package in eslint-config-eslint
Version 5.0.2 of `eslint-config-eslint` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to a remote server. ## Recommendation The best course of…
-
Unscored —
The affected product is vulnerable to reflected cross-site scripting, which may allow an attacker to remotely execute a…
-
High —
Cross-Site Scripting in react-marked-markdown
All versions of `react-marked-markdown` are vulnerable to cross-site scripting (XSS) via `href` attributes. This is exploitable if user is provided to `react-marked-markdown` Proof of concept: ``` import React from 'react' import ReactDOM from 'react-dom' imp…
-
Medium —
Out-of-bounds Read in base64url
Versions of `base64url` before 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below. ## Recommendation Update to version 3.0.0 or later.
-
Unscored —
The affected product is vulnerable to cross-site request forgery, which may allow an attacker to modify different confi…
-
Critical 9.8
Malicious Package in ladder-text-js
`ladder-text-js` contained a malicious script that attempted to delete all files when `npm test` was run. ## Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
-
Critical 9.8
Malicious Package in nothing-js
`nothing-js` contained a malicious script that attempted to delete all files when `npm test` was run. ## Recommendation This module has been unpublished from the npm Registry. If you find this module in your environment remove it.
-
Unscored —
The affected product is vulnerable to stored cross-site scripting, which may allow an attacker to remotely execute arbi…
-
Critical 9.8
Malicious Package in getcookies
The `getcookies` module contained a backdoor that would allow for a remote attacker to execute arbitrary commands on the system running the malicious module. ## Recommendation This module should be uninstalled if found used within an application. In addition …
-
Critical —
Malicious Package in dictum.js
Version 1.0.5 of `dictum.js` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.0.5…
-
Critical 9.8
Malicious Package in nginxbeautifier
Version 1.0.14 of `nginxbeautifier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If versio…
-
Critical —
Malicious Package in xoc
Version 1.0.7 of `xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.0.7 of th…
-
Critical —
Malicious Package in simple-alipay
Version 1.0.1 of `simple-alipay` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1…
-
High 8.8
Cross-Site Request Forgery in MAGMI
Currently, all versions of MAGMI are vulnerable to CSRF due to the lack of CSRF tokens. RCE (via phpcli command) is possible in the event that a CSRF is leveraged against an existing admin session for MAGMI.
-
Critical 9.8
Authentication bypass in MAGMI
MAGMI versions prior to 0.7.24 are vulnerable to a remote authentication bypass due to allowing default credentials in the event there is a database connection failure. A remote attacker can trigger this connection failure if the Mysql setting max_connections…
-
Critical —
Malicious Package in s3asy
Version 0.4.8 of `s3asy` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.4.8 of …
-
Critical —
Malicious Package in react-server-native
Version 0.0.7 of `react-server-native` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If ver…
-
Critical —
Malicious Package in react-dates-sc
Version 0.3.0 of `react-dates-sc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version …
-
Critical —
Malicious Package in rc-calendar-jhorst
Version 8.4.3 of `rc-calendar-jhorst` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If vers…
-
Critical —
Malicious Package in oauth-validator
Version 1.0.2 of `oauth-validator` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version…
-
Critical —
Malicious Package in modlibrary
Version 0.1.1 of `modlibrary` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.1.…
-
Critical 9.8
Malicious Package in json-serializer
Version 2.0.10 of `json-serializer` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If versio…
-
Unscored —
A ZTE product has a DoS vulnerability. Because the equipment couldn’t distinguish the attack packets and normal packets…
-
Critical —
Malicious Package in jasmin
Version 0.0.3 of `jasmin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.3 of…
-
Unscored —
A ZTE product is impacted by the cryptographic issues vulnerability. The encryption algorithm is not properly used, so …
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The username variable w…
-
Critical 10.0
A remote code execution vulnerability exists in the install functionality of OS4Ed openSIS 7.4. The password variable w…
-
Unscored —
USVN (aka User-friendly SVN) before 1.0.10 allows attackers to execute arbitrary code in the commit view.
-
Unscored —
USVN (aka User-friendly SVN) before 1.0.10 allows CSRF, related to the lack of the SameSite Strict feature.
-
Critical 9.9
A remote code execution vulnerability exists in the Modules.php functionality of OS4Ed openSIS 7.3. A specially crafted…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email par…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email par…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the…
-
Critical 9.8
SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email par…
-
Critical 9.8
Malicious Package in freshdom
Version 0.0.6 of `freshdom` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.6 …
-
Critical 9.8
Malicious Package in impala
Version 1.1.7 of `impala` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 1.1.7 of…
-
Critical 9.8
Malicious Package in dossier
Version 0.0.4 of `dossier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0.0.4 o…
-
Critical 9.8
Malicious Package in dynamo-schema
Version 0.0.3 of `dynamo-schema` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If version 0…
-
Critical —
Malicious Package in css_transform_step
Version 1.0.6 of `css_transform_step` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If vers…
-
Critical —
Malicious Package in css_transform_support
Version 1.0.2 of `css_transform_support` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=` ## Recommendation If v…