cve.bz

CWE-506: Embedded Malicious Code, page 2

Filter

The product contains code that appears to be malicious in nature.

What the weakness is: CWE-506 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures

Related attack patterns (CAPEC): 3
  • CAPEC-442 Infected Software Likelihood: Medium · Severity: High
  • CAPEC-448 Embed Virus into DLL Likelihood: Medium · Severity: High
  • CAPEC-636 Hiding Malicious Data or Code within Files Severity: High

The attack patterns MITRE's CAPEC relates to CWE-506, as MITRE names them. Credits.

Ask an AI about CWE-506

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-506: Embedded Malicious Code and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/506.html and https://cve.bz/cve/cwe/506?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2025-54313KEVEPSS 5.1%

    eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows.

  2. 9.3CVE-2025-32965EPSS 0.9%

    xrpl.js is a JavaScript/TypeScript API for interacting with the XRP Ledger in Node.js and the browser. Versions 4.2.1, 4.2.2, 4.2.3, and 4.2.4 of xrpl.js were compromised and contained malicious code designed to exfiltrate private keys. Ve…

  3. 8.6CVE-2025-30154KEVEPSS 2.5%

    reviewdog/action-setup is a GitHub action that installs reviewdog. reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs.…

  4. 8.6CVE-2025-30066KEVEPSS 72%

    tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. (The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit…

  5. 8.7CVE-2024-4978KEVEPSS 27%

    Justice AV Solutions Viewer Setup 8.3.7.250-1 contains a malicious binary when executed and is signed with an unexpected authenticode signature. A remote, privileged threat actor may exploit this vulnerability to execute of unauthorized Po…

  6. 10.0CVE-2024-3094EPSS 91%

    Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the sou…

  7. 9.8CVE-2023-2003EPSS 0.9%

    Embedded malicious code vulnerability in Vision1210, in the build 5 of operating system version 4.3, which could allow a remote attacker to store base64-encoded malicious code in the device's data tables via the PCOM protocol, which can th…

  8. 2.3CVE-2021-22887EPSS 0.3%

    A vulnerability in the BIOS of Pulse Secure (PSA-Series Hardware) models PSA5000 and PSA7000 could allow an attacker to compromise BIOS firmware. This vulnerability can be exploited only as part of an attack chain. Before an attacker can c…

  9. 9.1CVE-2020-15165EPSS 1.3%

    Version 1.1.6-free of Chameleon Mini Live Debugger on Google Play Store may have had it's sources or permissions tampered by a malicious actor. The official maintainer of the package is recommending all users upgrade to v1.1.8 as soon as p…

  10. 7.3CVE-2017-16207EPSS 0.7%

    discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.

  11. 7.5CVE-2017-16205EPSS 1.1%

    The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

  12. 7.5CVE-2017-16204EPSS 1.1%

    The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

  13. 7.5CVE-2017-16203EPSS 1.1%

    The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

  14. 7.5CVE-2017-16202EPSS 1.2%

    The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

  15. 9.8CVE-2017-16128EPSS 1.4%

    The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.

  16. 7.5CVE-2017-16081EPSS 1.3%

    cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  17. 7.5CVE-2017-16080EPSS 1.1%

    nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  18. 7.5CVE-2017-16079EPSS 1.1%

    smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  19. 7.5CVE-2017-16078EPSS 1.1%

    shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  20. 7.5CVE-2017-16077EPSS 1.2%

    mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  21. 7.5CVE-2017-16076EPSS 1.1%

    proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  22. 7.5CVE-2017-16075EPSS 1.2%

    http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  23. 7.5CVE-2017-16074EPSS 1.2%

    crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  24. 7.5CVE-2017-16073EPSS 1.1%

    noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  25. 7.5CVE-2017-16072EPSS 1.2%

    nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  26. 7.5CVE-2017-16071EPSS 1.1%

    nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  27. 7.5CVE-2017-16070EPSS 1.2%

    nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  28. 7.5CVE-2017-16069EPSS 1.2%

    nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  29. 7.5CVE-2017-16068EPSS 1.2%

    ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  30. 7.5CVE-2017-16067EPSS 1.1%

    node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  31. 7.5CVE-2017-16066EPSS 1.1%

    opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  32. 7.5CVE-2017-16065EPSS 1.2%

    openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  33. 7.5CVE-2017-16064EPSS 1.2%

    node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  34. 7.5CVE-2017-16063EPSS 1.1%

    node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  35. 7.5CVE-2017-16060EPSS 1.2%

    babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  36. 7.5CVE-2017-16059EPSS 1.1%

    mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  37. 7.5CVE-2017-16058EPSS 1.1%

    gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  38. 7.5CVE-2017-16057EPSS 1.1%

    nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  39. 7.5CVE-2017-16056EPSS 1.1%

    mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  40. 7.5CVE-2017-16055EPSS 1.1%

    `sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  41. 7.5CVE-2017-16054EPSS 1.2%

    `nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  42. 7.5CVE-2017-16053EPSS 1.1%

    `fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  43. 7.5CVE-2017-16052EPSS 1.2%

    `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  44. 7.5CVE-2017-16051EPSS 1.3%

    `sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  45. 7.5CVE-2017-16050EPSS 1.1%

    `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  46. 7.5CVE-2017-16049EPSS 1.2%

    `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  47. 7.5CVE-2017-16048EPSS 1.2%

    `node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  48. 7.5CVE-2017-16046EPSS 1.1%

    `mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  49. 7.5CVE-2017-16045EPSS 1.1%

    `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  50. 7.5CVE-2017-16044EPSS 1.5%

    `d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.