ROS-20250619-03

A vulnerability in the Microsoft Visual Studio software development tool, the Microsoft.NET software platform, and the Build Tools for Visual Studio toolkit is associated with an incorrect external external vulnerability. Microsoft.NET and Build Tools for Visual Studio toolkit is related to...

The vulnerability of Microsoft Visual Studio, the Microsoft.NET platform, and the Build Tools for Visual Studio toolset lies in improper external control of file names or files, allowing attackers to perform spoofing attacks.

The vulnerability of Microsoft Visual Studio, the Microsoft.NET platform, and the Build Tools for Visual Studio toolset is related to improper external name handling or file path manipulation. Exploitation of this vulnerability can allow a malicious actor to perform spear-phishing attacks by...

CVE-2025-26646

The CVE-2025-26646 entry relates to External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio, enabling spoofing over a network. Connected sources specify affected stack as .NET/Visual Studio tooling and provide concrete patch lines: for .NET 8.0, mitigations...

CVE-2025-26646 .NET, Visual Studio, and Build Tools for Visual Studio Spoofing Vulnerability

...

Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed vulnerabilities in several Developer Tools. A malicious party can exploit the vulnerabilities to carry out attacks that can lead to the following categories of damage: - Circumvention of a security measure - Execution of arbitrary code user privileges - Access to sensitive dat...

UBUNTU-CVE-2025-26646

External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network...

PT-2025-21127

Name of the Vulnerable Software and Affected Versions: .NET versions prior to the fixed version Visual Studio affected versions not specified Build Tools for Visual Studio affected versions not specified Description: The issue allows an authorized attacker to perform spoofing over a network due t...

@angular/build (>=20.0.0-next.7 <=20.0.0-next.8), @cyberskill/shared (>=1.92.0 <=1.127.0) +29 more potentially affected by CVE-2025-46565 via vite (>=6.3.0 <=6.3.3)

vite NPM version =6.3.0, =20.0.0-next.7, =1.92.0, =0.0.10, =1.0.101, =0.0.1, =2.15.20, =0.2.0, =0.2.5 - @nebula-db/orm =0.2.3 - @nebula-db/plugin-cache =0.2.3 - @nebula-db/plugin-encryption =0.2.3 and more Source cves: CVE-2025-46565 Source advisory: OSV:GHSA-859W-5945-R5V3...

PT-2024-40490 · Pypi · Pyo3

Name of the Vulnerable Software and Affected Versions: PyO3 versions 0.23.0 through 0.23.2 Description: The issue arises from a regression in the PYO3 CONFIG FILE environment variable, which is used to configure builds. This regression causes PyO3 to fail to reconfigure and recompile when the...

@superdesk/build-tools (>=1.0.0 <=2.0.1), @ucp-npm/components (>=0.0.4-beta <=0.0.19-beta) +5 more potentially affected by CVE-2024-43370 via gettext.js (>=0.5.5 <=1.2.0)

gettext.js NPM version =0.5.5, =1.0.0, =0.0.4-beta, =1.0.0, =1.0.1, =1.0.0, =0.0.6, =0.0.12 - gettext.js-po-loader =0.0.2 Source cves: CVE-2024-43370 Source advisory: OSV:GHSA-VWHG-JWR4-VXGG...

[SECURITY] Fedora 40 Update: opentest4j-1.3.0-6.fc40

Open Test Alliance for the JVM is a minimal common foundation for testing libraries on the JVM. The primary goal of the project is to enable testing frameworks like JUnit, TestNG, Spock, etc. and third-party assertion libraries like Hamcrest, AssertJ, etc. to use a common set of exceptions that...

From Spring Native to Spring Boot 3

Today, we are finishing to transition the Spring support for building native executables from the experimental Spring Native project to the official Spring Boot GraalVM native image support. In practice, that means we are archiving the Spring Native GitHub repository and moving it to the...

XXE vulnerability on agents in Jenkins SourceMonitor Plugin

SourceMonitor Plugin 0.2 and earlier does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to control XML input files for the 'Publish SourceMonitor results' post-build step to have agent processes parse a crafted file that uses external entities...

A Bootiful Podcast: Google mad scientist Josh Suereth on Observability with OpenTelemetry, building better build tools, and so much more

Hi, Spring fans! In this installment, Josh Long @starbuxman looks at the latest and greatest in Spring Boot 3 AOT, then talks to Googles Josh Suereth @jsuereth about observability with OpenTelemetry, building better build tools, and so much more. Want to learn more about Spring Boot and the wider...

Native Support in Spring Boot 3.0.0-M5

The Spring Team has been working on native image support for Spring Applications for quite some time. After 3+ years of incubation in the Spring Native experimental project with Spring Boot 2, native support is moving to General Availability with Spring Framework 6 and Spring Boot 3! Native image...

[SECURITY] Fedora 36 Update: golang-x-mobile-0-0.13.20220719git8578da9.fc36

The Go mobile repository holds packages and build tools for using Go on mobile platforms...

Malicious code in usaa-nw-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f8770fd569e77308417d4270871ab91fb9903d97683fd91c6e3259e6950bd2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6848 Malicious code in usaa-nw-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f8770fd569e77308417d4270871ab91fb9903d97683fd91c6e3259e6950bd2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5088 Malicious code in opbox-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de28bacc1f61f09e5b27ca443c3518a782a3fa7286a891c60d87b35c5c1c1db4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in opbox-build-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de28bacc1f61f09e5b27ca443c3518a782a3fa7286a891c60d87b35c5c1c1db4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...