Malicious code in postcss-cordelia-mutation-cz-conventional-changelog (npm)

The package postcss-cordelia-mutation-cz-conventional-changelog was found to contain malicious code...

MAL-2025-17905 Malicious code in cz-conventional-changelog-meissa-proxima-pulsar (npm)

The package cz-conventional-changelog-meissa-proxima-pulsar was found to contain malicious code...

MAL-2025-16787 Malicious code in changelog-prosthetics-cryovolcano-comet (npm)

The package changelog-prosthetics-cryovolcano-comet was found to contain malicious code...

MAL-2025-17906 Malicious code in cz-conventional-changelog-resolvers-xenon-bootstrap (npm)

The package cz-conventional-changelog-resolvers-xenon-bootstrap was found to contain malicious code...

MAL-2025-17616 Malicious code in cosmicsilence-changelog-electron-builder-auth0 (npm)

The package cosmicsilence-changelog-electron-builder-auth0 was found to contain malicious code...

SUSE-SU-2025:02657-1 Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: Update to upstream tag jdk-21.0.8+9 July 2025 CPU: Security fixes: - CVE-2025-30749: several scenarios can lead to heap corruption bsc1246595 - CVE-2025-30754: incomplete handshake may lead to weakening TLS protections bsc1246598 -...

rsdirectory

Extension: RSDirectory! Version: Old 2.2.7 / New 2.2.8 Update details: Versions affected 1.0.0 through 2.2.7 Stored XSS allows remote authenticated attackers to inject arbitrary web script or HTML via the review reply component. Fixed in 2.2.8 Update URL:...

Fedora 43 : lw-cli (2025-40bd0d18e6)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-40bd0d18e6 advisory. Automatic update for lw-cli-0.7.0-3.fc43. Changelog Sat Jul 12 2025 Mikel Olasagasti Uranga - 0.7.0-3 - Adopt Go Vendor Tools - Closes rhbz2340803 rhbz235231...

Malware in conventional-changelog-action

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in conventional-changelog-action (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 824c344ea468bb338b2b69885de649068ca830ed86879b6b8d0142a646097470 Any computer that has this package installed or running should be considered...

SUSE SLES15: tomcat10 / tomcat10-admin-webapps / tomcat10-el-5_0-api / etc (SUSE-SU-2025:01537-1)

The remote SUSE Linux SLES15 / SLESSAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:01537-1 advisory. Update to Tomcat 10.1.40 - CVE-2025-31650: invalid priority field values should be ignored bsc1242008 - CVE-2025-31651: Better...

Fedora: Security Advisory (FEDORA-2024-966c267928)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-1aff9a0e04)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2025-e4c104502d)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-0bebaff45f)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-30628

Kiwi TCMS is an open source test management system. In kiwitcms/Kiwi v12.2 and prior and kiwitcms/enterprise v12.2 and prior, the changelog.yml workflow is vulnerable to command injection attacks because of using an untrusted github.headref field. The github.headref value is an attacker-controlle...

CVE-2019-18955

The web console in Lansweeper 7.2.105.2 has XSS via the URL path. Product vulnerability has been fixed and disclosed within changelog as of 02 Dec 2019...

CVE-2019-10414

Jenkins Git Changelog Plugin 2.17 and earlier stored credentials unencrypted in job config.xml files on the Jenkins master where they could be viewed by users with Extended Read permission, or access to the master file system...

CVE-2011-1821

IBM Tivoli Directory Server TDS 5.2 before 5.2.0.5-TIV-ITDS-IF0010 on Windows allows remote authenticated users to cause a denial of service daemon hang via a cn=changelog search...

Malicious code in conventional-changelog-tf-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e4563668a074433d8fe6d149eeaf021077e3767d7b7b1cd5bf7825960098f937 The OpenSSF Package Analysis project identified 'conventional-changelog-tf-a' @ 100.11.1337 npm as malicious. It is considered malicious because...