Malicious code in militaty-geza-blessed2025hondo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f68cc04dd7a67be9ecd2b61249ad24d3e6b39c02fd0195aa04d3e1652294da0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sendmoneyserv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22431b45239f04c82c7ad749764ff1a438263e5fb1fa13236061aecdd49bf1b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-29913

CVE-2025-29913 affects CryptoLib (versions ≤ 1.3.3). The vulnerability is in the function Crypto_TC_Prep_AAD, where an incorrect calculation of the MAC start index can underflow an unsigned integer, causing an out-of-bounds access in the ingest buffer and leading to a heap-based buffer overflow. ...

MAL-2025-2449 Malicious code in real-world1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c283f503b8625f549d7d7eae7699333b3d1ecf140d4aded77c129247c0ba1217 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2448 Malicious code in @flutterfire/source-ui-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d5007a2c3f744fc79ba88f20dcf5897470581ccbb3a076b83a10d43ad9c6f5e7 The OpenSSF Package Analysis project identified '@flutterfire/source-ui-widgets' @ 1.0.0 npm as malicious. It is considered malicious because: -...

CVE-2023-33300

A improper neutralization of special elements used in a command 'command injection' in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited, unauthorized file access via specifically crafted request in inter-server communication port...

CVE-2025-27594

The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack...

Malicious code in ionicaiosampleapp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae3e09f0b7537140686ef5504c21e18b301f44e502feb68aad99bd4c5346a876 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2440 Malicious code in whatsapp-sdk-docs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 788206c160622c7c87f5e0b19b4be9383f89a8918fa3aace86ec99350a06daa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2439 Malicious code in starrocks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d61ee110d66f318505d0819f7b6e5ebf2b3767911b91e2748bdf5a911decbcb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-33300

A improper neutralization of special elements used in a command 'command injection' in Fortinet FortiNAC 7.2.1 and earlier, 9.4.3 and earlier allows attacker a limited, unauthorized file access via specifically crafted request in inter-server communication port...

CVE-2024-40590

An improper certificate validation vulnerability CWE-295 in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and below when connecting to a FortiManager device, a FortiAnalyzer device, or an SMTP server may allow an unauthenticated attacker in a...

CVE-2024-40590

CVE-2024-40590 describes an improper certificate validation (CWE-295) in FortiPortal. Affected are FortiPortal versions 7.4.0, 7.2.4 and below, 7.0.8 and below, and 6.0.15 and below when connecting to a FortiManager device, FortiAnalyzer device, or an SMTP server. This allows an unauthenticated a...

GSMA Confirms End-to-End Encryption for RCS, Enabling Secure Cross-Platform Messaging

The GSM Association GSMA has formally announced support for end-to-end encryption E2EE for securing messages sent via the Rich Communications Services RCS protocol, bringing much-needed security protections to cross-platform messages shared between Android and iOS platforms. To that end, the new...

Malicious code in oasis-os-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0855cc5a073138729aaaff78692f8f6b631c4466abbd62dc4a8d7407b86ea5e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2346 Malicious code in oasis-os-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0855cc5a073138729aaaff78692f8f6b631c4466abbd62dc4a8d7407b86ea5e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-27594

The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack...

CVE-2025-27594

The CVE-2025-27594 entry concerns the SICK DL100-2xxxxxxx series where a proprietary protocol transmits configuration data and authenticates devices without encryption. The underlying issue is the unencrypted protocol, which can allow an attacker to intercept the authentication hash and perform a...

NFC: nci: Add bounds checking in nci_hci_create_pipe()

...

Malicious code in messaging-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9fec082e41ee10acbec950c120b5c9c4a3184fbe0ce6995a3da0356c826601e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...