Snyk Security Database

sc-geeksquad-core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs

Affected versions of this package are vulnerable to Denial of Service (DoS) via the fetch_audio and fetch_image functions. An attacker can exhaust server memory by supplying a URL that points to an arbitrarily large file, causing the application to read the entire response without size limitation.

org.apache.cxf:cxf-rt-ws-security is a services framework that helps you build and develop services using frontend programming APIs, like JAX-WS and JAX-RS.

Affected versions of this package are vulnerable to Improper Authentication due to the STSTokenValidator token-validation cache in rt/ws/security/src/main/java/org/apache/cxf/ws/security/trust/STSTokenValidator.java. An attacker can authenticate as another user by supplying a crafted security token, such as a UsernameToken or self-signed SAML assertion, whose 32-bit hash collides with a previously validated token. When the validator treats that cache hit as proof of prior validation, it skips the normal password check, signature trust verification, and STS call. This lets the attacker obtain accepted identity claims or STS-issued tokens for the victim’s identity, breaking authentication for users who rely on CXF’s STS-backed token validation.