Malicious code in roblox-badges (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 631332631f47abd7acead3d283e6d06c693fe8e56c3f235bb0855b8fce3fe8a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8853 Malicious code in roblox-event-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f08f30c6d48fad2d39e96f192eb0efb0ae97511a98d6ef6b3048b20486f7c30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8850 Malicious code in azure-iothub-service-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 39be68a1794d85382ecb02d31e4d56c310788c3eb8f0f552d464410ec90138a5 The OpenSSF Package Analysis project identified 'azure-iothub-service-client' @ 0.0.2 npm as malicious. It is considered malicious because: - Th...

Exploit for Missing Authorization in Sonaar Mp3_Audio_Player_For_Music\,_Radio_\&_Podcast

CVE-2024-7856 ★ CVE-2024-7856 Arbitrary File deletion PoC ★...

MAL-2024-8848 Malicious code in balvant-chavda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2a4352948540614eef450d227df439f2f1c0d1da030df382e59831548767f473 The OpenSSF Package Analysis project identified 'balvant-chavda' @ 1.8.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-10225 Malicious code in mobileye-8-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e7b3a006f16102113625364a266a513016fe138d66a4008fc548e6df97c1a9a8 The OpenSSF Package Analysis project identified 'mobileye-8-connect' @ 7.7.8 npm as malicious. It is considered malicious because: - The package...

MAL-2024-10226 Malicious code in ori-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b71bf5ca700406e224508f08266da2a443693d48eb216c3854de6be0d1451346 The OpenSSF Package Analysis project identified 'ori-poc' @ 1.0.3 npm as malicious. It is considered malicious because: - The package executes o...

Malicious code in ori-gabriel-test2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 97118bb098b3b51630483b77d70977a582c54e3768ff5c54a65435870b3840de The OpenSSF Package Analysis project identified 'ori-gabriel-test2' @ 7.7.9 npm as malicious. It is considered malicious because: - The package...

MAL-2024-8835 Malicious code in skibo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2926d03211dc44468a65561ad4c8faa1e35ea81bbff5dcfb9bd4a918bd603384 The OpenSSF Package Analysis project identified 'skibo' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates...

Malicious code in iojds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c829100704731a4406f783062c0ccf13e42c91dcf3284731aa1d272a93fe8d0f The OpenSSF Package Analysis project identified 'iojds' @ 9.0.0 npm as malicious. It is considered malicious because: - The package communicates...

YubiKey Side-Channel Attack

There is a side-channel attack against YubiKey access tokens that allows someone to clone a device. Its a complicated attack, requiring the victims username and password, and physical access to their YubiKey--as well as some technical expertise and equipment. Still, nice piece of security analysi...

MAL-2025-4666 Malicious code in proto-google-cloud-dlp-v2beta1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1d21bb408ed0e178e23e5b4face7188968fd711ea7ceab009b9d04e6a508740d Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2025-5239 Malicious code in youreallydontwantthispackage2132 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 594e65e2115609e28b51abcb8b97695199a1eda6a4b72b2513bef87f5a74a211 Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

MAL-2024-9446 Malicious code in flag-leak-r (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 88c1df06a02daf1a911f895df0bd495b0f0d2e72f3b9ad45fe5a837575379c9e Generic campaign for all likely research / pentests, where the amount or art of collected data raises questions about the privacy, security and ethical side. -...

Security Bulletin: Vulnerabilities in Apache Ant affect IBM Operations Analytics - Log Analysis (CVE-2020-11023, CVE-2020-23064, CVE-2020-11022)

Summary There are multple cross site scripting vulnerabilities in Apache Ant that effect IBM Operations Analytics - Log Analysis. These have been addressed. Vulnerability Details CVEID:CVE-2020-11023 DESCRIPTION: jQuery is vulnerable to cross-site scripting, caused by improper validation of...

Security Bulletin: Netty vulnerability in Apache Solr affect IBM Operations Analytics - Log Analysis

Summary There is a potential validation vulnerability in Netty that is used by Apache Solr. This has been addressed Vulnerability Details IBM X-Force ID: 221368 DESCRIPTION: Netty is vulnerable to a man-in-the-middle attack, caused by improper hostname verification. An attacker could exploit this...

The vulnerability of the PDF file analysis component in the ClamAV antivirus program allows a hacker to trigger a service failure.

The vulnerability of the PDF file analysis component in the ClamAV antivirus program is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to cause service failures when the user downloads a specially crafted PDF file for analysis...

MAL-2024-8819 Malicious code in 0g-storage-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 189712c4a0b96b9447f3a3e68e5883de6303d027035935681f2341e68eeccc3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Baxter Connex Health Portal

View CSAF 1. EXECUTIVE SUMMARY CVSS v3.1 10.0 ATTENTION : Exploitable remotely/low attack complexity Vendor : Baxter Equipment : Connex Health Portal Vulnerabilities : SQL Injection, Improper Access Control 2. RISK EVALUATION Successful exploitation of these vulnerabilities could lead to...

SUSE CVE-2024-44956

In the Linux kernel, the following vulnerability has been resolved: drm/xe/preemptfence: enlarge the fence critical section It is really easy to introduce subtle deadlocks in preemptfenceworkfunc since we operate on single global ordered-wq for signalling our preempt fences behind the scenes, so...