Malicious code in newrelic-infra-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d13f7915d1227dc54cc2f1481a151b94b159d4ec2941d00db71133b636b5ed1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in newrelic-infra-operator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-10374

CVE-2025-10374 affects Shenzhen Sixun Business Management System version 7/11. The vulnerability resides in an improper authorization in the file /Adm/OperatorStop, enabling remote exploitation. Exploitation is possible with no privileges and no user interaction; CVSS notes POSsible high impact o...

PT-2025-37393

Name of the Vulnerable Software and Affected Versions: Shenzhen Sixun Business Management System versions 7/11 Description: A security flaw exists in Shenzhen Sixun Business Management System that allows for improper authorization. The issue affects an unknown part of the file /Adm/OperatorStop a...

Linux Distros Unpatched Vulnerability : CVE-2022-26308

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Pandora FMS v7.0NG.760 and below allows an improper access control in Configuration Credential store where a user with the role of Operator Write could create,...

CVE-2025-58056 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, wildfly, kserve-modelmesh, apache-nifi, sonarqube, apicurio-registry, wavefront-proxy, zipkin, thingsboard, docker-selenium, flyway, opensearch, tez, trino, strimzi-kafka-operator, celeborn, druid, selenium, akhq...

GHSA-FGHV-69VJ-QJ49 vulnerabilities

Vulnerabilities for packages: apache-activemq-artemis, wildfly, kserve-modelmesh, apache-nifi, sonarqube, apicurio-registry, wavefront-proxy, zipkin, thingsboard, docker-selenium, flyway, opensearch, tez, trino, strimzi-kafka-operator, celeborn, druid, selenium, akhq...

CVE-2025-58056 vulnerabilities

Vulnerabilities for packages: kayenta-fips, trino, infinispan, apache-activemq-artemis, logstash, management-api-for-apache-cassandra-4.0, opensearch, elasticsearch, apache-hop, localstack, zipkin, keycloak, seata, neo4j, celeborn, spark, apicurio-registry, kayenta, grpc-java-fips, wavefront-prox...

GHSA-FGHV-69VJ-QJ49 vulnerabilities

Vulnerabilities for packages: kayenta-fips, trino, infinispan, apache-activemq-artemis, logstash, management-api-for-apache-cassandra-4.0, opensearch, elasticsearch, apache-hop, localstack, zipkin, keycloak, seata, neo4j, celeborn, spark, apicurio-registry, kayenta, grpc-java-fips, wavefront-prox...

CVE-2025-36193

IBM Transformation Advisor 2.0.1 through 4.3.1 incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Transformation Advisor Operator Catalog image...

Security Bulletin: Multiple vulnerabilities in IBM MQ Operator and Queue manager container images

Summary Multiple vulnerabilities were addressed in IBM MQ Operator and Queue manager container images Vulnerability Details CVEID:CVE-2025-32415 DESCRIPTION: In libxml2 before 2.13.8 and 2.14.x before 2.14.2, xmlSchemaIDCFillNodeTables in xmlschemas.c has a heap-based buffer under-read. To exploi...

CVE-2025-9842

A vulnerability was detected in Das Parking Management System 停车场管理系统 6.2.0. This impacts an unknown function of the file /Operator/Search. The manipulation results in information disclosure. The attack may be performed from remote. The exploit is now public and may be used...

CVE-2025-9843

A flaw has been found in Das Parking Management System 停车场管理系统 6.2.0. Affected is an unknown function of the file /Operator/FindAll. This manipulation causes information disclosure. It is possible to initiate the attack remotely. The exploit has been published and may be used...

GHSA-3P8M-J85Q-PGMJ vulnerabilities

Vulnerabilities for packages: zookeeper, trino, infinispan, apache-activemq-artemis, logstash, cassandra-fips, management-api-for-apache-cassandra-4.0, opensearch, elasticsearch, apache-hop, localstack, zipkin, keycloak, seata, zookeeper-fips, neo4j, celeborn, kafka, spark, apicurio-registry,...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.0.15 Images Update

New images are available for Red Hat build of Keycloak 26.0.15 and Red Hat build of Keycloak 26.0.15 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Ha...

Moderate: Red Hat Security Advisory: Red Hat build of Keycloak 26.2.8 Images Security Update

New images are available for Red Hat build of Keycloak 26.2.8 and Red Hat build of Keycloak 26.2.8 Operator, running on OpenShift Container Platform Red Hat build of Keycloak is an integrated sign-on solution, available as a Red Hat JBoss Middleware for OpenShift containerized image. The Red Hat...

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API.

...

CVE-2025-36193

IBM Transformation Advisor 2.0.1 through 4.3.1 incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Transformation Advisor Operator Catalog image...

CVE-2025-36193

IBM Transformation Advisor 2.0.1 through 4.3.1 incorrectly assigns privileges to security critical files which could allow a local root escalation inside a container running the IBM Transformation Advisor Operator Catalog image...

CVE-2025-36193

IBM Transformation Advisor is affected by CVE-2025-36193, with versions 2.0.1 through 4.3.1 vulnerable to privilege escalation due to incorrect permissions on security-critical files, enabling local root escalation inside the IBM Transformation Advisor Operator Catalog container. The Red Hat secu...