Threats affecting pkg:generic/mosquitto

The npm package 'dowload_ebok_visioning_new_and_minority_religions_by_eugene_v_gallagher_n9z7a' contains malicious code that compromises any computer on which it is installed or run. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control.

The npm package 'dowload_ebok_desert_star_volume_2_by_enrico_marini_stephen_desberg_5cvyz' contains malicious code that compromises any computer on which it is installed or run. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine.

The npm package 'dowload_ebok_decadence_by_michel_onfray_cpbyr' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to stored secrets and keys. Immediate removal of the package is advised, but complete remediation cannot be guaranteed due to potential persistent malicious software. Secrets and keys should be rotated from a separate, uncompromised system.

Vault's Login MFA feature had a vulnerability where it did not consistently enforce expiration of pending two-phase login requests. This flaw could allow a user who completed the first authentication factor to finalize MFA and obtain a Vault token after the request should have expired, even if the user's primary credential was rotated. The issue is fixed in Vault Community Edition 2.2.2 and Vault Enterprise versions 2.2.2, 1.21.14, and 1.19.26.

A vulnerability in D-Bus occurs when the daemon uses the Unix select() fallback for event monitoring and fails to check if file descriptor numbers exceed allocated limits. A local attacker can exploit this by opening many concurrent connections, causing a stack out-of-bounds write that crashes the daemon and results in a denial of service. This fallback path is not active in default configurations, and typical builds use native Linux event polling mechanisms instead. Exploitation requires exhausting over 1024 file descriptors and is limited to local users.

Dolibarr versions before 24.0.2 have an insecure direct object reference (IDOR) vulnerability in the REST Documents API for the ticket module. This flaw allows authenticated API users with ticket read permission to access ticket attachments belonging to other companies by bypassing a company-scope check that is only applied during public ticket authentication sessions, which REST API authentication does not set. Attackers can enumerate ticket identifiers and retrieve sensitive attachments such as invoices and contracts from other parties.

VITEC EZ TV Platform Server versions prior to 8.5.0 have an unrestricted file upload vulnerability in the upload handler. This flaw allows unauthenticated remote attackers to upload arbitrary files by specifying a target filename in the X-FILENAME request header without authentication or file type validation. Malicious ASPX files can be uploaded directly to a web-accessible directory and executed by the web server, enabling remote code execution. Patches are available for versions 8.3.0, 8.3.1, 8.4.0, and 8.4.1. Users on versions before 8.3.0 should upgrade to 8.5.0 or later.

A vulnerability in dbus allows a local attacker to cause a denial of service by triggering an infinite retry loop in the socket transport layer. This occurs when the attacker connects to an affected service, requests a response, and then stops socket reads while keeping the connection open. The resulting continuous retry loop leads to excessive CPU consumption, impacting process availability without compromising data or privileges.

The npm package 'dowload_ebok_walking_the_americas_by_levison_wood_lkum4' contains malicious code that compromises any computer on which it is installed or running. Installation of this package results in full system compromise, potentially exposing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious software introduced by it.

Injection Guard plugin for WordPress versions before 1.4.0 has a cross-site request forgery (CSRF) vulnerability. This flaw allows unauthenticated attackers to trick a logged-in administrator into triggering a password hash export. The vulnerability arises because the ig_settings admin page processes GET parameters without nonce verification. Exploitation results in writing WooCommerce customer email and password hashes to an unprotected file, which can be downloaded without authentication for offline cracking.

The Post to Google My Business plugin for WordPress versions before 3.5.7 contains a blind server-side request forgery (SSRF) vulnerability. Authenticated users with Contributor-level privileges or higher can exploit this flaw by supplying a crafted URL that triggers a server request to arbitrary hosts. This can be used to scan internal ports, probe internal services, and access cloud metadata endpoints, bypassing network perimeter defenses.

Flowise versions through 3.1.4 have a server-side request forgery (SSRF) vulnerability that allows authenticated users with specific permissions to bypass SSRF protections in the Custom Function sandbox. This bypass is achieved by requiring a module subpath inside an allowlisted package, which evades sandbox checks and returns an unwrapped HTTP client. Exploitation enables attackers to send arbitrary HTTP requests to internal network addresses or cloud metadata endpoints, potentially leading to network mapping, credential disclosure, and unauthorized state changes on internal services.

Kanbanz by Softaculous plugin for WordPress versions before 1.0.3 has a broken access control vulnerability. This flaw allows authenticated Kanban Staff users to access and modify boards they do not belong to by exploiting admin-ajax handlers that do not properly enforce access checks. Attackers can manipulate board_id or task_id parameters to read sensitive data, modify task details, inject comments, and manage attachments on unauthorized boards.

Vault Community Edition and Vault Enterprise versions prior to 2.2.2, 1.21.14, and 1.19.25 did not correctly apply explicit ACL deny rules to letter case variants of user and group names in certain authentication methods. This flaw could allow an authenticated user with delegated permissions to modify protected users or groups, potentially leading to privilege escalation. The issue has been fixed in the specified patched versions.

A vulnerability exists due to dependency on a vulnerable third-party component in Johnson Controls FX Server, FX80, and FX90 products. This flaw allows an attacker with low privileges to access, modify, or delete files. The issue affects versions of FX Server before 14.10.10 and 14.14.1, FX80 before 14.14.10 and 14.14.1, and FX90 before 14.10.10 and 14.14.1. The vulnerability has a high severity score of 8.5.

LearnPress Course Wishlist Add-on versions before 4.1.2 have an insecure direct object reference (IDOR) vulnerability. This flaw allows remote attackers to manipulate any user's course wishlist by supplying an arbitrary user_id parameter to a REST API endpoint instead of relying on session identity. The vulnerability affects the publicly accessible load_content_via_ajax REST route, which requires only a public wp_rest nonce. Attackers can add or remove courses from any user's wishlist and check if a course is wishlisted by iterating user_id and course_id values.

A vulnerability in FRRouting (FRR) versions 8.3 through 10.5.1 exists in the bgp_notify_decapsulate_hard_reset() function, which improperly validates the length of the data field in a BGP NOTIFICATION Cease/Hard Reset message. When the data field is exactly one byte, this leads to an out-of-bounds heap read and an assertion failure, causing the bgpd daemon to crash and terminate all BGP sessions, resulting in a denial of service. This issue is fixed in versions 10.0.5, 10.1.5, 10.2.6, 10.3.4, 10.4.3, 10.5.2, and 10.6.0.

The npm package 'dowload_ebok_smiley_by_laurann_dohner_7okd1' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.

The npm package 'dowload_ebok_lettre_a_ma_fille_by_maya_angelou_gt68h' contains malicious code that can fully compromise any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by this package.

The npm package 'dowload_ebok_historia_de_un_oso_by_gabriel_osorio_antonia_herrera_ti9e1' is identified as malicious software. Installing or running this package results in a fully compromised system, potentially allowing an attacker full control. Immediate removal of the package is advised, along with rotation of all secrets and keys from a separate, uncompromised device. However, removal of the package alone may not eliminate all malicious components due to the extensive control gained by the attacker.