13253 matches found
Malicious code in profound-gray-grasshopper (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cbd0fbe549adf9cfbf2db3df1f64377a2540538a34b3a2243167ae9f9d12805 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-67127 Malicious code in cautious-plum-chameleon (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 368c9042c83f8950aa8c0edc648b79403189299aafc5db04a902331ea2c43f3c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-62353 Malicious code in citra-tumis62-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3617241e910a645956a0c0b5145421fe7ac739c40fe865a1af7a2ece2397302a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in ida-brongkos75-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c89be3f058209a45605990dba1d51746a0bd0d5a1782c273bd976440658ccc14 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
RHEL 10 : shadow-utils (RHSA-2025:20145)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:20145 advisory. The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user...
ALSA-2025:20957 Important: runc security update
The runC tool is a lightweight, portable implementation of the Open Container Format OCF that provides container runtime. Security Fixes: runc: container escape via 'masked path' abuse due to mount race conditions CVE-2025-31133 runc: container escape with malicious config due to /dev/console mou...
Advantech WebAccess/VPN Absolute Path Traversal Vulnerability
Advantech WebAccess/VPN is a virtual private network feature integrated in Advantech WebAccess/SCADA software, designed to provide a secure and reliable network connectivity solution for industrial automation and remote monitoring systems. An absolute path traversal vulnerability exists in...
PT-2025-51635
Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains an issue in the pinctrl subsystem, specifically within the s32cc driver. The s32 pinctrl desc structure is allocated using devm kmalloc, but not all of its fiel...
RHEL 10 : sssd (RHSA-2025:21020)
The remote Redhat Enterprise Linux 10 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2025:21020 advisory. The System Security Services Daemon SSSD service provides a set of daemons to manage access to remote directories and authentication mechanisms. It...
EUVD-2025-48940
Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, an administrator can, by editing the configuration of the iTop instance, execute code on the server. Versions 2.7.13 and 3.2.2 escape and check the config parameter before executing a command based on i...
EUVD-2025-48945
Tenda AX-1803 v1.0.0.1 was discovered to contain a stack overflow via the time parameter in the SetSysTimeCfg function. This vulnerability allows attackers to cause a Denial of Service DoS via a crafted request...
Malicious code in strategic_flyingfish_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a593b3fcacc31dc2503c2db4ecd67917ea5f71350902fad28f225f1eb5533d0b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-60907 Malicious code in naked_antelope_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ba6921e31ea1c7de66c574e7056b9ab2f77b31ca235d6dbe74e82272cb3d9ca This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in gita-asinan11-sukiwir (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bba5166dd2777510eced389b179a3acf445cd0f9633a5b4e4a0b2e0eda3eb5c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-12418
Potential Denial of Service issue in all supported versions of Revenera InstallShield version 2025 R1, 2024 R2, 2023 R2, and prior. When e.g., a local administrator performs an uninstall, a symlink may get followed on removal of a user writeable configuration directory and induce a Denial of...
curl: Arbitrary Configuration File Inclusion: via External Control of File Name or Path
Summary: The Arbitrary Configuration File Inclusion ACFI vulnerability was identified in the curl utility via the --config option. This flaw is a form of External Control of File Name or Path CWE-73, occurring due to the lack of adequate validation on the user-supplied configuration file path. An...
MAL-2025-52154 Malicious code in kurnia-sambel24-miaww (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5e49572d4fa613f63c1701317498ea12b1e22ff9f798891b3b624b4362917a95 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-52455 Malicious code in tomi-empal69-riris (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 861821462d0dffa39ab848a90625b3483ab066dcc70b66758376a435bfa4b0ae The package tomi-empal69-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flooded...
MantisBT Authorization Issue Vulnerability (CNVD-2025-28527)
MantisBT is a Web-based open source defect tracking system of the MantisBT team . The system provides project management and defect tracking services in the form of Web operations. An authorization issue vulnerability exists in MantisBT 2.27.1 and earlier versions, which stems from insufficient...
