netbird/advisory-database
0
0
Fork 0
mirror of https://github.com/netbirdio/advisory-database.git synced 2026-05-22 18:04:22 -07:00
Code Issues Packages Projects Releases Wiki Activity

Advisory Database Sync

Browse Source
This commit is contained in:
advisory-database[bot]
2024-12-05 05:12:46 +00:00
parent 3bf5e8df6a
commit d0ad48b388
959 changed files with 1274 additions and 3822 deletions
Download Patch File Download Diff File Expand all files Collapse all files
advisories/github-reviewed/2020/09/GHSA-3wjm-33mw-h388/GHSA-3wjm-33mw-h388.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-3wjm-33mw-h388",
"modified": "2023-07-27T20:10:51Z",
"published": "2020-09-01T20:34:14Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in s3asy",
"details": "Version 0.4.8 of `s3asy` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 0.4.8 of this module is found installed you will want to replace it with a version before or after 0.4.8. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.4.7",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:30:46Z",
advisories/github-reviewed/2020/09/GHSA-48hw-37g6-3gw4/GHSA-48hw-37g6-3gw4.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-48hw-37g6-3gw4",
"modified": "2023-07-27T20:35:38Z",
"published": "2020-09-03T02:35:41Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in mx-nested-menu",
"details": "Version 0.1.30 of `mx-nested-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.1.29",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:41:33Z",
advisories/github-reviewed/2020/09/GHSA-4c87-gg2q-fc6m/GHSA-4c87-gg2q-fc6m.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-4c87-gg2q-fc6m",
"modified": "2023-07-27T20:14:11Z",
"published": "2020-09-01T20:31:04Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in rc-calendar-jhorst",
"details": "Version 8.4.3 of `rc-calendar-jhorst` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 8.4.3 of this module is found installed you will want to replace it with a version before or after 8.4.3. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 8.4.2",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:30:40Z",
advisories/github-reviewed/2020/09/GHSA-4j54-mmmv-hjpm/GHSA-4j54-mmmv-hjpm.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-4j54-mmmv-hjpm",
"modified": "2023-07-27T20:05:27Z",
"published": "2020-09-03T19:17:51Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in slush-fullstack-framework",
"details": "Version 0.9.2 of `slush-fullstack-framework` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.9.1",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:47:33Z",
advisories/github-reviewed/2020/09/GHSA-54cr-gv8w-8324/GHSA-54cr-gv8w-8324.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-54cr-gv8w-8324",
"modified": "2023-07-27T20:32:35Z",
"published": "2020-09-01T20:36:22Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in xoc",
"details": "Version 1.0.7 of `xoc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 1.0.7 of this module is found installed you will want to replace it with a version before or after 1.0.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.5",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:30:51Z",
advisories/github-reviewed/2020/09/GHSA-563h-697m-j7x5/GHSA-563h-697m-j7x5.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-563h-697m-j7x5",
"modified": "2023-07-27T20:36:07Z",
"published": "2020-09-03T19:18:58Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in device-mqtt",
"details": "Version 1.0.11 of `device-mqtt` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.10",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:47:35Z",
advisories/github-reviewed/2020/09/GHSA-5645-gc7h-98h8/GHSA-5645-gc7h-98h8.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-5645-gc7h-98h8",
"modified": "2023-07-27T20:13:07Z",
"published": "2020-09-01T20:32:07Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in react-dates-sc",
"details": "Version 0.3.0 of `react-dates-sc` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 0.3.0 of this module is found installed you will want to replace it with a version before or after 0.3.0. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.3.0-beta.83",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:30:42Z",
advisories/github-reviewed/2020/09/GHSA-5w4r-wwc3-6qcp/GHSA-5w4r-wwc3-6qcp.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-5w4r-wwc3-6qcp",
"modified": "2023-07-27T20:33:34Z",
"published": "2020-09-11T21:23:29Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in precode.js",
"details": "Version 1.1.1 of `precode.js` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.1.0",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:41:20Z",
advisories/github-reviewed/2020/09/GHSA-76wf-2xcf-6wmx/GHSA-76wf-2xcf-6wmx.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-76wf-2xcf-6wmx",
"modified": "2023-07-27T20:16:16Z",
"published": "2020-09-03T00:31:28Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in ngx-pica",
"details": "Version 1.1.5 of `ngx-pica` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.1.4",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:41:36Z",
advisories/github-reviewed/2020/09/GHSA-78p3-96hc-3j47/GHSA-78p3-96hc-3j47.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-78p3-96hc-3j47",
"modified": "2023-07-27T20:31:07Z",
"published": "2020-09-03T19:11:17Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in jquery-airload",
"details": "Version 0.2.5 of `jquery-airload` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.2.4",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:47:19Z",
advisories/github-reviewed/2020/09/GHSA-8qh7-xw58-3ww7/GHSA-8qh7-xw58-3ww7.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-8qh7-xw58-3ww7",
"modified": "2023-07-27T20:14:43Z",
"published": "2020-09-11T21:25:37Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in radic-util",
"details": "Version 1.0.2 of `radic-util` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.1",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:41:22Z",
advisories/github-reviewed/2020/09/GHSA-c722-pv5w-cfg2/GHSA-c722-pv5w-cfg2.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-c722-pv5w-cfg2",
"modified": "2023-07-27T20:17:08Z",
"published": "2020-09-11T21:20:14Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in github-jquery-widgets",
"details": "Version 0.1.2 of `github-jquery-widgets` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.1.1",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:41:02Z",
advisories/github-reviewed/2020/09/GHSA-cxcf-78mr-wpg7/GHSA-cxcf-78mr-wpg7.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-cxcf-78mr-wpg7",
"modified": "2023-07-27T20:11:25Z",
"published": "2020-09-01T20:29:59Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in oauth-validator",
"details": "Version 1.0.2 of `oauth-validator` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 1.0.2 of this module is found installed you will want to replace it with a version before or after 1.0.2. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.1",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:30:37Z",
advisories/github-reviewed/2020/09/GHSA-fgfj-rj24-mj7q/GHSA-fgfj-rj24-mj7q.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-fgfj-rj24-mj7q",
"modified": "2023-07-27T20:16:43Z",
"published": "2020-09-02T21:47:08Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in kraken-api",
"details": "Version 0.1.8 of `kraken-api` contains malicious code as a postinstall script. When installed, the package calls home to a Command and Control server to execute arbitrary commands.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\n\nUsers may consider downgrading to version 0.1.7\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:40:22Z",
advisories/github-reviewed/2020/09/GHSA-fwvp-x5gj-773j/GHSA-fwvp-x5gj-773j.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-fwvp-x5gj-773j",
"modified": "2023-07-27T20:35:13Z",
"published": "2020-09-01T20:33:10Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in react-server-native",
"details": "Version 0.0.7 of `react-server-native` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 0.0.7 of this module is found installed you will want to replace it with a version before or after 0.0.7. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.0.6",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:30:44Z",
advisories/github-reviewed/2020/09/GHSA-fx6f-fpfv-5hmc/GHSA-fx6f-fpfv-5hmc.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-fx6f-fpfv-5hmc",
"modified": "2023-07-27T20:11:54Z",
"published": "2020-09-03T19:10:12Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in uploader-plugin",
"details": "Version 1.0.2 of `uploader-plugin` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.1",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:47:14Z",
advisories/github-reviewed/2020/09/GHSA-j5jc-jf8f-86q7/GHSA-j5jc-jf8f-86q7.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-j5jc-jf8f-86q7",
"modified": "2023-07-27T20:34:44Z",
"published": "2020-09-01T20:38:30Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in dictum.js",
"details": "Version 1.0.5 of `dictum.js` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 1.0.5 of this module is found installed you will want to replace it with a version before or after 1.0.5. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.4",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:30:56Z",
advisories/github-reviewed/2020/09/GHSA-j5qg-46p9-w2rp/GHSA-j5qg-46p9-w2rp.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-j5qg-46p9-w2rp",
"modified": "2023-07-27T20:37:08Z",
"published": "2020-09-03T00:33:32Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in jekyll-for-github-projects",
"details": "Version 0.2.12 of `jekyll-for-github-projects` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.2.11",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:41:08Z",
advisories/github-reviewed/2020/09/GHSA-jf55-rgpx-p6rx/GHSA-jf55-rgpx-p6rx.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-jf55-rgpx-p6rx",
"modified": "2023-07-27T20:31:34Z",
"published": "2020-09-03T19:12:22Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in iie-viz",
"details": "Version 1.0.4 of `iie-viz` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.3",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:47:21Z",
advisories/github-reviewed/2020/09/GHSA-m7xv-7p93-g6q8/GHSA-m7xv-7p93-g6q8.json
+3 -9
View File
@@ -3,14 +3,10 @@
"id": "GHSA-m7xv-7p93-g6q8",
"modified": "2023-07-27T20:05:00Z",
"published": "2020-09-03T00:35:35Z",
"aliases": [
],
"aliases": [],
"summary": "Malicious Package in libubx",
"details": "Version 1.0.3 of `libubx` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.2",
"severity": [
],
"severity": [],
"affected": [
{
"package": {
@@ -29,9 +25,7 @@
}
],
"database_specific": {
"cwe_ids": [
],
"cwe_ids": [],
"severity": "CRITICAL",
"github_reviewed": true,
"github_reviewed_at": "2020-08-31T18:41:13Z",

Some files were not shown because too many files have changed in this diff Show More