FreeBSD -- OpenSSH Keystroke Obfuscation Bypass

Problem Description: A logic error in the ssh1 ObscureKeystrokeTiming feature on by default rendered this feature ineffective. Impact: A passive observer could detect which network packets contain real keystrokes, and infer the specific characters being transmitted from packet timing...

Security Bulletin: Denial of service due to GraphQL Java in IBM WebSphere Application Server Liberty affect IBM Operations Analytics - Log Analysis (CVE-2024-40094)

Summary There is a vulnerability in the GraphQL Java library used by IBM WebSphere Application Server Liberty shipped with IBM Operations Analytics - Log Analysis. Vulnerability Details CVEID:CVE-2024-40094 DESCRIPTION: GraphQL Java aka graphql-java is vulnerable to a denial of service, caused by...

MAL-2025-595 Malicious code in digitalexp-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9833903519bade9052cdd1225ca96239d62fbff6d2cfc10be31dc013063ee830 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-596 Malicious code in home-assignment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 243807d7ae6247f1bee104dab17a677c3ec10064973a5ac7b3e5f4ff2753d35a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in testbcms (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 992b63c655205db655d1d67e1520392056934475ceef3b2d77371f64618d8fb2 The OpenSSF Package Analysis project identified 'testbcms' @ 1.3.8 npm as malicious. It is considered malicious because: - The package...

CVE-2025-0065

creationtimestamp| type| source ---|---|--- 2025-01-28 10:23:32+00:00| seen| https://infosec.exchange/users/cve/statuses/113905487848074528 2025-01-28 11:15:28+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lgsdbqlg7r2n 2025-01-28 12:00:20+00:00| seen|...

MAL-2025-592 Malicious code in kuvvet_poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a15f57daa0dfb5fe047124342523add2a4d20eebd28713661823ae555930135 The OpenSSF Package Analysis project identified 'kuvvetpoc' @ 1.0.3 npm as malicious. It is considered malicious because: - The package...

Rockwell Automation DataMosaix Private Cloud

RISK EVALUATION Successful exploitation of these vulnerabilities could overwrite reports, including user projects. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all...

Rockwell Automation FactoryTalk

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to execute code on the device with elevated privileges. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize...

MAL-2025-591 Malicious code in theice (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6a5284ff23f0c6a6b960f00ae8adcf8fd068d714b2689229fa6355a69fc5d778 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-590 Malicious code in sandstorm-widgets-nyse-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 521032aa86f84d6ee0bb3ad2b7b97e43683ed2040212f5b7cb5359f10549fea6 The OpenSSF Package Analysis project identified 'sandstorm-widgets-nyse-website' @ 7.0.1 npm as malicious. It is considered malicious because: -...

OSV-2025-68 UNKNOWN READ in std::__1::__function::__func<cv::PngDecoder::compose_frame

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=392318892 Crash type: UNKNOWN READ Crash state: std::1::function::funccv::PngDecoder::composeframe cv::ParallelLoopBodyWrapper::operator cv::ThreadPool::run...

Ollama Multiples Vulnerabilities

According to the self-reported version in its response header, the version of Ollama hosted on the remote is, affected by a Multiples Vulnerabilities : - File existence disclosure through the api. When calling the CreateModel route with a path parameter that does not exist - A Denial Of Service...

MAL-2025-607 Malicious code in tomcrypt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b12e31166b9da18d6c4615c1c464ce1a94906441a1501a3d77e03b0b44092f86 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-588 Malicious code in @adsk-forks/jsonpath (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b3b2039104a753b08abe81f7754ff405d8e3206c92b7251c857b28e3431fdc4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nord-security-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42ffe2bd7d3ef7fd741f0a023ccfc4b06f7d44240710724da3048ed61dc1e7e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-606 Malicious code in nord-security-task (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 42ffe2bd7d3ef7fd741f0a023ccfc4b06f7d44240710724da3048ed61dc1e7e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test-test-121333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ed3e1b0420eb26040693b16a06bc6803942f127119fd8cf4082268891ea0db5f The OpenSSF Package Analysis project identified 'test-test-121333' @ 1.1.2 npm as malicious. It is considered malicious because: - The package...

MAL-2025-586 Malicious code in test-test-121333 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ed3e1b0420eb26040693b16a06bc6803942f127119fd8cf4082268891ea0db5f The OpenSSF Package Analysis project identified 'test-test-121333' @ 1.1.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in meli-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c7d0ea07d51fa1a590737fa0586578db983b776c21cb15f0597463d7046dea8 The OpenSSF Package Analysis project identified 'meli-cache' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...