176 matches found
Fedora: Security Advisory (FEDORA-2025-5906618a59)
The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
User Impersonation
Overview Affected versions of this package are vulnerable to User Impersonation due to trusting reverse-proxy headers by default. An attacker can bypass IP-based access restrictions by crafting requests with malicious X-Forwarded-For headers. Remediation Upgrade...
Malicious Package
Overview github.com/bpoorman/uid is a malicious package. This package contains malicious code and uses typosquatting to trick users into downloading and installing it instead of the legitimate uuid package. The malicious payload attempts to exfiltrate sensitive data via the Valid function, which...
AZL-71605 CVE-2025-65637 affecting package jx for versions less than 3.2.236-24
A denial-of-service vulnerability exists in github.com/sirupsen/logrus when using Entry.Writer to log a single-line payload larger than 64KB without newline characters. Due to limitations in the internal bufio.Scanner, the read fails with "token too long" and the writer pipe is closed, leaving...
Malicious code in yq-go (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d5276b7426a78180800c09848c996c357433cc3cec323ca62f8c45b89b14bf7 The package yq-go was found to contain malicious code...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...
Malicious code in github.com/boltdb-go/bolt (Git)
--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1cad7a46a80076eedc2c3c00be0d3215bdfed842f6cc04c238d3b2591b38e2ad This malicious git repository is a typosquat of the legitimate BoltDB Go package. It contains a backdoor that enables remote code executio...
arkadiyt-projects: Arbitrary File Write
A path traversal vulnerability was discovered in the protodump tool. The vulnerability allowed for arbitrary file writes outside the intended output directory due to insufficient validation of the gopackage option extracted from embedded protobuf descriptors. The Filename function extracted the...
EUVD-2024-1387
Malicious code in bioql PyPI...
EUVD-2023-2602
Malicious code in bioql PyPI...
EUVD-2022-7731
Malicious code in bioql PyPI...
Security Bulletin: Vulnerability in go package in nginx-controller affects IBM Db2 Data Management Console
Summary go package in nginx-controller open source library is used by IBM Db2 Data Management Console . This bulletin describes the upgrades necessary to address the vulnerability. Vulnerability Details CVEID:CVE-2023-24532 DESCRIPTION: An unspecified error with return an incorrect result in the...
Possible private key restoration in go package github.com/ecies/go
...
CVE-2025-58058
CVE-2025-58058 — xz (Go) memory allocation issue : The xz library (Go implementation) prior to 0.5.14 can allocate the full LZMA decoding buffer immediately after reading the header, before detecting improper data prepending to the stream. The LZMA header lacks a mandatory magic/checksum to catch...
SQL Injection
Overview Affected versions of this package are vulnerable to SQL Injection via the SelectListByPage function in the DictTypeDao.go file when processing the orderByColumn and isAsc arguments. An attacker can execute arbitrary SQL commands by supplying crafted input to these parameters. Remediation...
Malicious code in @zalastax/nolb-go_ (npm)
The package @zalastax/nolb-go was found to contain malicious code...
MAL-2025-39601 Malicious code in xdh-go (npm)
The package xdh-go was found to contain malicious code...
Malicious Package
Overview github.com/cavernouskina/mcp-go is a malicious package. This package contains malicious code designed to provide attackers with on-demand remote access to a developer's system or CI/CD environment. The package and some other variants use typosquatting to imitate legitimate packages. Upon...
Malicious Package
Overview github.com/wetteepee/hcloud-ip-floater is a malicious package. This package contains malicious code designed to provide attackers with on-demand remote access to a developer's system or CI/CD environment. The package and some other variants use typosquatting to imitate legitimate package...