CVE-2025-6224

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it...

CVE-2025-6224 Key leakage in juju/utils certificates

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it...

Malware in keythereum-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in keythereum-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e190a6b75c720484c00bc747f1ea989c80b20733327b6a0ff26d29538aa471f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5504 Malicious code in keythereum-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e190a6b75c720484c00bc747f1ea989c80b20733327b6a0ff26d29538aa471f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in cors-utils

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in cors-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1abd9a442ac1ffe60c6124eb55921e24de7e14058f76293e8e316f69d378a734 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5493 Malicious code in cors-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1abd9a442ac1ffe60c6124eb55921e24de7e14058f76293e8e316f69d378a734 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-27515

Name of the Vulnerable Software and Affected Versions: juju/utils affected versions not specified Description: The issue concerns the generation of certificates in juju/utils using the cert.NewLeaf function, which could potentially include private information. If such a certificate is transferred...

CVE-2025-6224: Cleartext Storage of Sensitive Information

Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the network in plaintext, an attacker listening on that network could sniff the certificate and trivially extract the private key from it...

Malicious code in robinhood-internal-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5350c4af558b6036e996982e7ac060be1ac0516b91dfd7b983a5c0b5d76270ec The OpenSSF Package Analysis project identified...

MAL-2025-5277 Malicious code in robinhood-internal-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5350c4af558b6036e996982e7ac060be1ac0516b91dfd7b983a5c0b5d76270ec The OpenSSF Package Analysis project identified...

Malicious code in utils-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2915f8670a8badcf10c91c6f4495435134004b4394050fd25077ced85b2176f Any computer that has this package installed or running should be considered...

MAL-2025-5472 Malicious code in utils-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2915f8670a8badcf10c91c6f4495435134004b4394050fd25077ced85b2176f Any computer that has this package installed or running should be considered...

Malware in @bb-ui-utils/memoizer

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in sap.ushell.components.tiles.utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c610571a96a422fc7b583bd55f4996dc51b894fe4d4a8cf415f7ebf1be5caf7 Any computer that has this package installed or running should be considered...

CVE-2025-52968

A potential Cross-site request forgery CSRF flaw was found in xdg-utils. The xdg-open function in xdg-utils through version 1.2.1 can send requests containing SameSite=Strict cookies, facilitating a Cross-site request forgery CSRF attack vector. Mitigation Mitigation for this issue is either not...

AZL-64296 CVE-2025-52968 affecting package xdg-utils 1.2.1-3

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...

DEBIAN-CVE-2025-52968

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...

UBUNTU-CVE-2025-52968

xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to, by default, associate x-scheme-handler/https with the execution of a browser with command-line options that arrange for an empty cookie...