56 matches found
MAL-2025-17114 Malicious code in cli-plugin-ngrok (npm)
The package cli-plugin-ngrok was found to contain malicious code...
MAL-2025-17111 Malicious code in cli-plugin-graphiql (npm)
The package cli-plugin-graphiql was found to contain malicious code...
Malicious code in cli-plugin-ngrok (npm)
The package cli-plugin-ngrok was found to contain malicious code...
MAL-2025-17115 Malicious code in cli-plugin-script (npm)
The package cli-plugin-script was found to contain malicious code...
Malicious code in cli-plugin-script (npm)
The package cli-plugin-script was found to contain malicious code...
Malicious code in cli-plugin-graphql (npm)
The package cli-plugin-graphql was found to contain malicious code...
MAL-2025-17112 Malicious code in cli-plugin-graphql (npm)
The package cli-plugin-graphql was found to contain malicious code...
Regular Expression Denial Of Service (ReDoS)
@vue/cli-plugin-pwa is vulnerable to Regular Expression Denial of Service ReDoS. The vulnerability is due to unsafe regex handling in the HtmlPwaPlugin component of the Markdown code handler, which can be exploited remotely to degrade performance...
@nodefony/monitoring-bundle (>=7.0.0-beta.3, <=7.0.0-beta.8), nodefony (>=7.0.0-beta.3, <=7.0.0-beta.8) potentially affected by CVE-2025-5897 via @vue/cli-plugin-pwa (5.0.8)
@vue/cli-plugin-pwa NPM version 5.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on @vue/cli-plugin-pwa and may be impacted: - @nodefony/monitoring-bundle =7.0.0-beta.3, =7.0.0-beta.3, =7.0.0-beta.8 Source cves: CVE-2025-5897 Source advisory:...
@nodefony/monitoring-bundle (>=7.0.0-beta.3, <=7.0.0-beta.8), nodefony (>=7.0.0-beta.3, <=7.0.0-beta.8) potentially affected by CVE-2025-5897 via @vue/cli-plugin-pwa (5.0.8)
@vue/cli-plugin-pwa NPM version 5.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on @vue/cli-plugin-pwa and may be impacted: - @nodefony/monitoring-bundle =7.0.0-beta.3, =7.0.0-beta.3, =7.0.0-beta.8 Source cves: CVE-2025-5897 Source advisory:...
ROS-20250515-04
The vulnerability of the docker CLI plugin that extends Buildx build capabilities is related to the fact that the software stores sensitive information in log files. software stores sensitive information in log files. Exploiting the vulnerability could allow an attacker to gain access to sensitiv...
CVE-2025-0495
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry...
CVE-2025-0495
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry...
CVE-2025-0495
CVE-2025-0495 affects docker-buildx/moby-buildx (Buildx) where credentials set as attribute values in cache-to/cache-from can be captured by OpenTelemetry traces and BuildKit history. Exploitation status is not detailed in the provided sources. The vulnerability does not apply to secrets passed v...
CVE-2025-0495 Secrets leakage to telemetry endpoint via cache backend configuration via buildx
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry...
CVE-2025-0495 Secrets leakage to telemetry endpoint via cache backend configuration via buildx
Buildx is a Docker CLI plugin that extends build capabilities using BuildKit. Cache backends support credentials by setting secrets directly as attribute values in cache-to/cache-from configuration. When supplied as user input, these secure values may be inadvertently captured in OpenTelemetry...
MAL-2024-11893 Malicious code in vue-cli-plugin-lint-staged (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb4c725718310cb969ec6171fad585bea2b58fc7d4460be6b706cb8529356d7a The OpenSSF Package Analysis project identified 'vue-cli-plugin-lint-staged' @ 9.9.7 npm as malicious. It is considered malicious because: - The...
Malicious code in vue-cli-plugin-lint-staged (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb4c725718310cb969ec6171fad585bea2b58fc7d4460be6b706cb8529356d7a The OpenSSF Package Analysis project identified 'vue-cli-plugin-lint-staged' @ 9.9.7 npm as malicious. It is considered malicious because: - The...