MAL-2025-76729 Malicious code in ade-papeda65-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4d1c7d1b3479b7ee456aac1747f23f4b9f58f3906a28e1cb5af3529b325560d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wati-rendang38-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 76d742f6d73fcabba5ed942fa6eacb00d0179ebb1282ebb22d5d0e84fcc16577 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in damaged-rose-vole (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6864f956817e62d551e1ffdfa62e3f5f356d9fbf61e309f57844970eab6ed5f2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68925 Malicious code in intact-crimson-rodent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 593f864bd2be15f0c9fcb8d837cca08ad4ac1b253c8da109b8714dcb1f4e640d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-70684 Malicious code in small-magenta-whale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f5dc848ef34ab27ef85e731483b99788cab7f05272a33ac77ee0c33c1a9db4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in past-sapphire-wombat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db19159f743e92941f4ade673f87684ea41cc0b81272779e6a256f1309f30bd5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60601 Malicious code in hilarious_pig_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fac26f2d009641adf1308f0dc1eaaffb648828c1ca4dc2766ca0f398fa2b491d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dian-brongkos89-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d50e0ff683eda9ac4dd15d50a6771690fae36c248df0c8ccd8fb25f919b065f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-58768 Malicious code in spontaneous_unicorn_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30657310a4b14ea562abd1c4a41fff435d963b72bc31a5a5edd515e738d1cb42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52217 Malicious code in maman-kupang98-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c834d1b5aca0774a30e6a2c2e707211758a0a9126aa34288cb7c53614619689 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-botok59-pore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd2ab92ae92f564a6e8c8beb24d8dc0cbfa803799e2a2bd359ac8c22bc992c47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joni-mendoan12-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189b3ffe97f66ee44c8ae891025598933dbd17015a30ec36ae252acbe02a871d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-semur14-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d74ef200d25a792259292e3390c1f6ea364971573a234182fa1329badc0131bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in candra-lengko4-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b640e95942b0a028eb5a6b76b28845de730bf6794f450493d4bd760398a61f88 The package candra-lengko4-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

USN-6310-1: json-c vulnerability

It was discovered that json-c incorrectly handled certain JSON files. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

GLSA-202305-37 : Apache Tomcat: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202305-37 Apache Tomcat: Multiple Vulnerabilities - If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Process Mining . CVE-2022-45143

Summary There is a vulnerability in Apache Tomcat could allow a remote attacker to bypass security restrictions. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2022-45143 DESCRIPTION: Apach...

Important: tomcat9

Issue Overview: The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing but extremely hard to trigger concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5...

@wmfs/addressbase-plus-blueprint (>=1.1.0, <=1.182.0), @wmfs/addressbase-premium-blueprint (>=1.0.0, <=1.185.0) +50 more potentially affected by CVE-2023-26132 via dottie (>=2.0.0, <=2.0.3)

dottie NPM version =2.0.0, =1.1.0, =1.0.0, =1.0.0, =1.11.0, =1.10.0, =1.0.0, =1.0.0, =1.0.0, =1.27.0, =1.6.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.8.0 and more Source cves: CVE-2023-26132 Source advisory: SNYK:JS-DOTTIE-3332763...

CVE-2023-25560

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...