MAL-2025-51718 Malicious code in erick-mendut98-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f93d693b98d489e951f4a323d8eeaaa58e0a3d3c1a70fe358324c1208112bf2 The package erick-mendut98-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

MAL-2025-50186 Malicious code in dewanto-lepet37-crottsekebon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c260437fdd66a56cc0024a37f96b55c30f715ab7b1b55b8949aa2468e0568f The package dewanto-lepet37-crottsekebon was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign th...

EUVD-2011-0486

Malware in sbrugna...

EUVD-2020-18739

Malware in sbrugna...

EUVD-2017-6295

Malware in sbrugna...

EUVD-2018-19405

Malware in sbrugna...

CVE-2020-26109

cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification SEC-557...

SUSE CVE-2011-0466

The API in SUSE openSUSE Build Service OBS 2.0.x before 2.0.8 and 2.1.x before 2.1.6 allows attackers to bypass intended write-access restrictions and modify a 1 package or 2 project via unspecified vectors...

GHSA-8823-XPHR-QW9V Gentoo Portage does not verify X.509 certificates from SSL servers

The urlopen function in pym/portage/util/urlopen.py in Gentoo Portage 2.1.12, when using HTTPS, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and modify binary package lists via a crafted certificate...

cPanel Protection Mechanism Bypass Vulnerability

cPanel is a set of Web-based host control management system of the U.S. cPanel. A protection mechanism bypass vulnerability exists in versions of cPanel prior to 88.0.13. An attacker can exploit this vulnerability to bypass the protection mechanism that restricts package modifications...

CVE-2020-26109

cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification SEC-557...

CVE-2020-26109

cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification SEC-557...

Authentication flaw

cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification SEC-557...

CVE-2020-26109

cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification SEC-557...

CVE-2020-26109

CVE-2020-26109 affects cPanel prior to version 88.0.13, where a protection mechanism intended to restrict package modification can be bypassed (SEC-557). The public documents consistently describe a bypass vulnerability enabling modification of packages despite the protection. Affected product: c...

CVE-2017-14806

A Improper Certificate Validation vulnerability in susestudio-common of SUSE Studio onsite allows remote attackers to MITM connections to the repositories, which allows the modification of packages received over these connections. This issue affects: SUSE Studio onsite susestudio-common version...

CVE-2019-1000012

Hex package manager version 0.14.0 through 0.18.2 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via victim fetches packages from malicious/compromised...

Design/Logic Flaw

Erlang/OTP Rebar3 version 3.7.0 through 3.7.5 contains a Signing oracle vulnerability in Package registry verification that can result in Package modifications not detected, allowing code execution. This attack appears to be exploitable via Victim fetches packages from malicious/compromised mirro...

CVE-2019-1000013

Hex Core (Hex package manager) versions 0.3.0 and earlier contain a Signing oracle vulnerability in the Package registry verification that can allow code execution. The issue arises when a victim fetches packages from a malicious or compromised mirror, potentially modifying packages without detec...

U.S. Dept Of Defense: Access to all █████████ files, including CAC authentication bypass

Summary: Due to an Insecure Direct Object Reference IDOR in adding recipients to a shared package on ██████████, an unauthenticated attacker can access all files uploaded to ████. As described on ██████████ website, this includes documents with classifications up to FOUO, including PII / PHI...