CVE-2025-54799 Lego does not enforce HTTPS

Let's Encrypt client and ACME library written in Go Lego. In versions 4.25.1 and below, the github.com/go-acme/lego/v4/acme/api package thus the lego library and the lego cli as well don't enforce HTTPS when talking to CAs as an ACME client. Unlike the http-01 challenge which solves an ACME...

Cleartext Transmission of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Transmission of Sensitive Information due to the lack of HTTPS enforcement for the ACME client. An attacker can intercept sensitive information by capturing unencrypted network traffic if the library user accidentally inputs a...

Lego 安全漏洞

Lego is a go-acme open source library written in Go. A security vulnerability exists in Lego 4.25.1 and earlier versions, which stems from not enforcing the use of HTTPS to communicate with CAs, potentially disclosing sensitive information...

PT-2025-32239 · Go Acme +1 · Lego +1

Name of the Vulnerable Software and Affected Versions: Lego versions 4.25.1 and below Description: The github.com/go-acme/lego/v4/acme/api package, and consequently the Lego library and command-line interface, does not enforce HTTPS when communicating with Certificate Authorities CAs as an ACME...

Fedora 43 : golang-github-acme-lego (2025-30bf3a7b1a)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-30bf3a7b1a advisory. Automatic update for golang-github-acme-lego-4.23.1-1.fc43. Changelog Mon Jul 7 2025 Mikel Olasagasti Uranga - 4.23.1-1 - Update to 4.23.1 and adopt Go Vendo...

SoK: Stablecoin Designs, Risks, and the Stablecoin LEGO

Stablecoins have become significant assets in modern finance, with a market capitalization exceeding USD 246 billion May 2025. Yet, despite their systemic importance, a comprehensive and risk-oriented understanding of crucial aspects like their design trade-offs, security dynamics, and...

Malicious code in vuepress-plugin-lego-analytics (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-3668 Malicious code in yandex-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36575d1c04d04a70393c42d013dfb94f94d1dd8211785aaa3b08414cdf0fb421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yandex-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36575d1c04d04a70393c42d013dfb94f94d1dd8211785aaa3b08414cdf0fb421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @airtel-lego/sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e126e868d890d40f42157c798a5f6385a6b2cadb73c9a125606b59c79057cfdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2075 Malicious code in @airtel-lego/sentry (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e126e868d890d40f42157c798a5f6385a6b2cadb73c9a125606b59c79057cfdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fedora 41 : golang-github-acme-lego (2024-f6f91d983c)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-f6f91d983c advisory. Automatic update for golang-github-acme-lego-4.17.4-4.fc41. Changelog Mon Jul 29 2024 Mikel Olasagasti Uranga - 4.17.4-4 - Update to 4.17.4 - Closes...

CVE-2023-37608

An issue in Automatic Systems SOC FL9600 FirstLane V06 legoT04E00 allows a remote attacker to obtain sensitive information because there is an automaticsystems super admin account with astech as its hardcoded password...

Malicious code in shein-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71ef45c393ee6ca8301bbc37b170265fd5ea03cca45f8e48d8e1c1b085c05665 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8523 Malicious code in shein-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 71ef45c393ee6ca8301bbc37b170265fd5ea03cca45f8e48d8e1c1b085c05665 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

LEGO Marketplace BrickLink Hacked? Website Down Amid Unusual Activity (Updated)

By Deeba Ahmed BrickLink confirms probing into unusual activity. This is a post from HackRead.com Read the original post: LEGO Marketplace BrickLink Hacked? Website Down Amid Unusual Activity Updated...

Malicious Package

Overview tools-access-lego is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...

Malicious Package

Overview lego-stuff is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious code in tools-access-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fddb963172387b40e3adf0f4314fb8b30ed7c12d5d3cf70e1ceb7388987313bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-896 Malicious code in tools-access-lego (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fddb963172387b40e3adf0f4314fb8b30ed7c12d5d3cf70e1ceb7388987313bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...