272 matches found
CVE-2026-33243
Barebox contains a vulnerability in the FIT signing flow: during mkimage, the hashed-nodes property of the FIT signature node is computed, but the hashed-nodes value is not itself protected by the hash. An attacker can modify hashed-nodes to influence which nodes were reported as hashed, potentia...
CVE-2026-33243 barebox: FIT Signature Verification Bypass Vulnerability
barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 and the corresponding backport to 2025.09.3, an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a...
CVE-2026-33243
barebox is a bootloader. In barebox from version 2016.03.0 to before version 2026.03.1 and the corresponding backport to 2025.09.3, an attacker could exploit a FIT signature verification vulnerability to trick the bootloader into booting different images than those that were verified as part of a...
PT-2026-26702
Name of the Vulnerable Software and Affected Versions barebox versions 2016.03.0 through 2025.09.2 barebox versions 2025.10.0 through 2026.03.0 Description barebox is a bootloader. When creating a FIT Firmware Image Table, the mkimage1 function sets the hashed-nodes property of the FIT signature...
Barebox 数据伪造问题漏洞
Barebox is a versatile and flexible bootloader developed by Barebox Open Source. Versions of Barebox before 2025.09.3 and 2026.03.1 contained a data manipulation vulnerability. This vulnerability stemmed from the fact that the hashed-nodes attribute set by mkimage during the creation of FIT was n...
Malicious code in iron-fit-behavior (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d3440b6e1d8f6bfca21cf53c207a766d966cc2ba5033d8557c044c91a8b950 The package iron-fit-behavior was found to contain malicious code. Source: ghsa-malware...
MAL-2026-1307 Malicious code in iron-fit-behavior (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d3440b6e1d8f6bfca21cf53c207a766d966cc2ba5033d8557c044c91a8b950 The package iron-fit-behavior was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview iron-fit-behavior is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
CVE-2021-27097
The boot loader in Das U-Boot before 2021.04-rc2 mishandles a modified FIT...
CVE-2021-27138
The boot loader in Das U-Boot before 2021.04-rc2 mishandles use of unit addresses in a FIT...
CVE-2022-50815
CVE-2022-50815 relates to the Linux kernel, addressing a vulnerability in ext2 after which the kernel was updated to add sanity checks for group and filesystem size. The issue arose because filesystem size could exceed the underlying device size and the group size might be too small to hold metad...
MAL-2025-126548 Malicious code in fit_bandicoot_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6cbde3107d3889e7d6ea2f9a5765692f1bfb621123fcd3882957043e0868c39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in fit_haddock_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 52946b4fe37a7f168a833259e0953c98c12ada9923d7604016e11bc302d62eb1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-98852
Malicious code in fitjaguarz3n npm...
EUVD-2025-98853
Malicious code in fithaddockz3n npm...
Malicious code in fit_warbler_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 22981a3bf4bfa9effcdf2da793fe3a20160b670508bf2b0e541d42ab746263bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-91891
Malicious code in fitcaterpillarz3n npm...
EUVD-2025-91890
Malicious code in fitechidnaz3n npm...