CVE-2025-4759

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one...

CVE-2025-4759: Incorrect Behavior Order: Early Validation

Versions of the package lockfile-lint-api before 5.9.2 are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name allowing an attacker to install other npm packages than the intended one...

PT-2025-21607 · Npm · Lockfile-Lint-Api

Name of the Vulnerable Software and Affected Versions: lockfile-lint-api versions prior to 5.9.2 Description: The issue concerns incorrect behavior order, specifically early validation, via the resolved attribute of the package URL validation. This can be bypassed by extending the package name,...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : cosign (SUSE-SU-2025:1333-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1333-1 advisory. - CVE-2024-6104: cosign: hashicorp/go-retryablehttp: Fixed sensitive information disclosure to l...

Security update for cosign

This update for cosign fixes the following issues: CVE-2024-6104: cosign: hashicorp/go-retryablehttp: Fixed sensitive information disclosure to log file bsc1227031 CVE-2024-51744: cosign: github.com/golang-jwt/jwt/v4: Fixed bad documentation of error handling in ParseWithClaims leading to...

@lavamoat/git-safe-dependencies (>=0.1.1, <=0.2.1) potentially affected by CVE-2025-4759 via lockfile-lint-api (5.9.1)

lockfile-lint-api NPM version 5.9.1 is affected by a known vulnerability. The following packages have a transitive dependency on lockfile-lint-api and may be impacted: - @lavamoat/git-safe-dependencies =0.1.1, =0.2.1 Source cves: CVE-2025-4759 Source advisory: SNYK:JS-LOCKFILELINTAPI-10169587...

Incorrect Behavior Order: Early Validation

Overview lockfile-lint-api is a Lint an npm or yarn lockfile to analyze and detect issues Affected versions of this package are vulnerable to Incorrect Behavior Order: Early Validation via the resolved attribute of the package URL validation which can be bypassed by extending the package name...

The vulnerability of the CI Lint API component of the software platform based on git for collaborative code development in GitLab allows a attacker to perform an SSRF attack.

The vulnerability of the CI Lint API component of the software platform based on Git for collaborative code development on GitLab is related to insufficient testing of server-side requests. Exploiting this vulnerability allows a malicious actor to perform an SSRF attack remotely...

VulnCheck KEV: CVE-2021-39935

GitLab Community and Enterprise Editions contain a server-side request forgery vulnerability which could allow unauthorized external users to perform Server Side Requests via the CI Lint API...

MAL-2025-1595 Malicious code in golanci-lint-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e69962c9a060f9d61253d944cc7c3573debc57053555bb4dd496618bc1b6510f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in golanci-lint-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e69962c9a060f9d61253d944cc7c3573debc57053555bb4dd496618bc1b6510f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: kube-state-metrics, ip-masq-agent, q, sonobuoy, prometheus-pushgateway, nuclei, rabbitmq-cluster-operator, flux-image-reflector-controller, render-template, s5cmd, cue, kyverno-policy-reporter-kyverno-plugin, vt-cli, aws-load-balancer-controller,...

UBUNTU-CVE-2024-11931

An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate protected CI variables via CI lint...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, and CI/CD continuous integration and continuous delivery features. A security vulnerability exists in GitLab, which can be exploited by an attacker to...

PT-2025-1718 · Gitlab · Gitlab Ce/Ee

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 17.0 through 17.6.3 GitLab CE/EE versions 17.7 through 17.7.2 GitLab CE/EE versions 17.8 through 17.8.0 Description: An issue has been discovered in GitLab CE/EE that affects users with a developer role, allowing them to...

CVE-2024-11931: Insufficient Granularity of Access Control

An issue has been discovered in GitLab CE/EE affecting all versions starting from 17.0 prior to 17.6.4, from 17.7 prior to 17.7.3, and from 17.8 prior to 17.8.1. Under certain conditions, it may have been possible for users with developer role to exfiltrate protected CI variables via CI lint...

Malicious code in eslint-config-proton-lint (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d595489e0b5943870a58ffcd154d1a8ab7b4bbd45155465dbe9272bb6471060 Any computer that has this package install...

MAL-2025-60 Malicious code in eslint-config-proton-lint (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d595489e0b5943870a58ffcd154d1a8ab7b4bbd45155465dbe9272bb6471060 Any computer that has this package install...

Malicious code in vue-cli-plugin-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb4c725718310cb969ec6171fad585bea2b58fc7d4460be6b706cb8529356d7a The OpenSSF Package Analysis project identified 'vue-cli-plugin-lint-staged' @ 9.9.7 npm as malicious. It is considered malicious because: - The...

MAL-2024-11893 Malicious code in vue-cli-plugin-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cb4c725718310cb969ec6171fad585bea2b58fc7d4460be6b706cb8529356d7a The OpenSSF Package Analysis project identified 'vue-cli-plugin-lint-staged' @ 9.9.7 npm as malicious. It is considered malicious because: - The...