CVE-2025-4759

MEDIUM Year: 2025
CVSS v3 Score
8.3
High
Weakness Type
CWE-179
View all →

Vulnerability Description

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one.

Related Vulnerabilities

CVE-2022-1271

HIGH
CVSS:8.8(High)

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker...

CWE-1792022

CVE-2022-1271

HIGH
CVSS:8.8(High)

An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's chosen file name (for example, a crafted file name), this can overwrite an attacker...

CWE-1792022

CVE-2024-41686

HIGH
CVSS:3.3(Low)

This vulnerability exists in SyroTech SY-GPON-1110-WDONT Router due to improper implementation of password policies. A local attacker could exploit this by creating password that do not adhere to the ...

CWE-1792024