Snyk Security Database

etoro-auth is a malicious package. This package contains malicious code. Although this package may be attempting to impersonate a legitimate organization, it has no connection to that organization or its authors.

snowflake-connector-python is a Snowflake Connector for Python

Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can obtain authentication tokens, encryption keys, pre-signed URLs, and SAML assertions by accessing diagnostic logs that were insufficiently redacted. This is only exploitable if the attacker has read access to the log destination, such as the local filesystem, a log aggregation service, or a CI/CD artifact store.

org.glassfish:jakarta.faces is an Oracle's implementation of the JavaServer Faces specification.

Affected versions of this package are vulnerable to Remote Code Execution due to path traversal in the resolveURL(URL source, String path) method of DefaultFaceletFactory, which passes a path that does not start with / straight into the URL constructor, so an absolute spec overrides the base URL. An attacker can execute code server-side by supplying an absolute URL such as http://attacker.example/rce.xhtml that Mojarra fetches, compiles, and evaluates as a Facelet including its #{...} EL expressions, or read arbitrary files through file:// and jar:file:// schemes. This requires the application to have a JSF page whose <ui:include src>, <ui:composition template>, or <ui:decorate template> value comes from user-controlled input, for example <ui:include src="#{param.p}" />.