DEBIAN-CVE-2025-48060

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jvstringvfmt in the jqfuzzexecute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void p = mallocsz;. As of time of publication, no patched versions are...

AZL-61968 CVE-2025-48060 affecting package jq for versions less than 1.7.1-4

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jvstringvfmt in the jqfuzzexecute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void p = mallocsz;. As of time of publication, no patched versions are...

ALPINE-CVE-2025-48060

jq is a command-line JSON processor. In versions up to and including 1.7.1, a heap-buffer-overflow is present in function jvstringvfmt in the jqfuzzexecute harness from oss-fuzz. This crash happens on file jv.c, line 1456 void p = mallocsz;. As of time of publication, no patched versions are...

An Empirical Study of Fuzz Harness Degradation

The purpose of continuous fuzzing platforms is to enable fuzzing for software projects via \emphfuzz harnesses -- but as the projects continue to evolve, are these harnesses updated in lockstep, or do they run out of date? If these harnesses remain unmaintained, will they \emphdegrade over time i...

bitcoin-harness (0.1.0), bitcoin_rpc_client (>=0.5.0, <=0.6.1) +65 more potentially affected by unknown CVE via openssl (>=0.10.40, <=0.10.68)

openssl CARGO version =0.10.40, =0.5.0, =0.2.0, =0.0.1, =0.1.0-alpha.0, =0.1.24, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.37.0-pre, =0.1.3, =0.1.10 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2025-0022...

bitcoin-harness (0.1.0), bitcoin_rpc_client (>=0.5.0, <=0.6.1) +82 more potentially affected by CVE-2025-24898 via openssl (>=0.10.7, <=0.10.68)

openssl CARGO version =0.10.7, =0.5.0, =0.2.0, =0.0.0, =0.0.1, =0.3.3, =0.6.25, =0.1.0-alpha.0, =0.0.3, =0.1.24, =0.37.0-pre, =0.4.0, =0.37.0-pre, =0.37.0-pre, =0.38.0 and more Source cves: CVE-2025-24898 Source advisory: OSV:GHSA-RPMJ-RPGJ-QMPM...

Malicious code in platform-harness-ecr-configmap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7812939dfec5496e941d5bd252e8f536d2b2e38984c285fd5881230dd705d928 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2024-11659 Malicious code in platform-harness-ecr-configmap (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7812939dfec5496e941d5bd252e8f536d2b2e38984c285fd5881230dd705d928 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Security Bulletin: IBM Security Verify Governance - Containerized Identity Manager has multiple vulnerabilities

Summary Multiple security vulnerabilities have been addressed in the latest update to IBM Security Verify Governance - Containerized Identity Manager. Vulnerability Details CVEID:CVE-2018-6561 DESCRIPTION: Dojo Toolkit is vulnerable to cross-site scripting in dijit.Editor, caused by improper...

Apache Cordova App Harness Targeted in Dependency Confusion Attack

Researchers have identified a dependency confusion vulnerability impacting an archived Apache project called Cordova App Harness. Dependency confusion attacks take place owing to the fact that package managers check the public repositories before private registries, thus allowing a threat actor t...

[SECURITY] Fedora 40 Update: maven-verifier-2.0.0~M1-7.fc40

Provides a test harness for Maven integration tests...

VulnCheck KEV: CVE-2021-21978

VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file upload in logupload web application. An unauthorized attacker with network access to View Planner Harness could...

Malicious code in harness-helm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0008cf12cac94140f089a7ba2a7d297c874737f5bfbd34256de9b47b44d084bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in helm-harness (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1885e5a787d7006f60d35663f556443b2741bdbeb22541aab9db6ce3725121e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3562 Malicious code in harness-helm-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0008cf12cac94140f089a7ba2a7d297c874737f5bfbd34256de9b47b44d084bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-848 Malicious code in adc-harness-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7b06bf53ab66bec43f96e96f529fb02bfd8c644d476f783f1a8c1ed63eadc92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in adc-harness-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7b06bf53ab66bec43f96e96f529fb02bfd8c644d476f783f1a8c1ed63eadc92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

new packages: perl-Test-Harness

An update is available for perl-Test-Harness. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

GHSA-VMQ9-CM7M-4P8P Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness

Dojo Dojo Objective Harness DOH version prior to version 1.14 contains a Cross Site Scripting XSS vulnerability in unit.html and testsDOH/base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliv...

Improper Neutralization of Input During Web Page Generation in Dojo Dojo Objective Harness

Dojo Dojo Objective Harness DOH version prior to version 1.14 contains a Cross Site Scripting XSS vulnerability in unit.html and testsDOH/base/loader/i18n-exhaustive/i18n-test/unit.html and testsDOH/base/i18nExhaustive.js in the DOH that can result in Victim attacked through their browser - deliv...