1052 matches found
MAL-2025-67415 Malicious code in confused-red-sparrow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf993bc186af8ace13c4c7fa0b58e3ebfa8bb8f4008322a4384297f382171e0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-55234
Malicious code in confused-red-sparrow npm...
EUVD-2025-55235
Malicious code in confused-harlequin-badger npm...
EUVD-2025-50514
Malicious code in confusedcrocodilez3n npm...
EUVD-2025-50512
Malicious code in confusedroosterz3n npm...
Unintended Proxy or Intermediary ('Confused Deputy')
Overview fastmcp is a The fast, Pythonic way to build MCP servers and clients. Affected versions of this package are vulnerable to Unintended Proxy or Intermediary 'Confused Deputy' during the authentication with OAuth providers that don't support Dynamic Client Registration DCR. An attacker can...
EUVD-2025-36666
FastMCP Auth Integration Allows for Confused Deputy Account Takeover...
FastMCP Auth Integration Allows for Confused Deputy Account Takeover
Summary FastMCP documentation covers the scenario where it is possible to use Entra ID or other providers for authentication. In this context, because Entra ID does not support Dynamic Client Registration DCR, the FastMCP-hosted MCP server is acting as the authorization provider, as declared in t...
GHSA-C2JP-C369-7PVX FastMCP Auth Integration Allows for Confused Deputy Account Takeover
Summary FastMCP documentation covers the scenario where it is possible to use Entra ID or other providers for authentication. In this context, because Entra ID does not support Dynamic Client Registration DCR, the FastMCP-hosted MCP server is acting as the authorization provider, as declared in t...
Preparing for the Digital Battlefield of 2026: Ghost Identities, Poisoned Accounts, & AI Agent Havoc
BeyondTrust's annual cybersecurity predictions point to a year where old defenses will fail quietly, and new attack vectors will surge. Introduction The next major breach won't be a phished password. It will be the result of a massive, unmanaged identity debt. This debt takes many forms: it's the...
PT-2025-43451
Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A flaw exists in the Framework component of Android operating systems related to insufficient protection of service data. Successful exploitation may allow a remote attacker to elevate...
PT-2025-43469
Name of the Vulnerable Software and Affected Versions MediaProvider.java affected versions not specified Description A flaw exists in multiple functions of MediaProvider.java that may allow a bypass of external storage write permissions due to a confused deputy condition. Successful exploitation...
PT-2025-43483
Name of the Vulnerable Software and Affected Versions affected versions not specified Description A flaw exists that may allow alteration of the primary user's face unlock settings due to a confused deputy condition. Successful exploitation could lead to physical escalation of privilege without...
PT-2025-43475
In onActivityResult of EditFdnContactScreen.java, there is a possible way to leak contacts from the work profile due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
Exploit for Confused Deputy in Google Android
Fix for this issue has appeared as CVE-2025-22441: bulletinht...
EUVD-2020-1714
Malware in sbrugna...
EUVD-2019-18667
Malware in sbrugna...
EUVD-2019-6423
Malware in sbrugna...