2024 matches found
CVE-2025-59336
Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of service by overwriting Phoenix runtime files. Package names like ../../package are not properly filtered and pass the validity check of the rockspec verification system. This...
Phoenix RowHammer Attack Bypasses Advanced DDR5 Memory Protections in 109 Seconds
A team of academics from ETH Zürich and Google has discovered a new variant of a RowHammer attack targeting Double Data Rate 5 DDR5 memory chips from South Korean semiconductor vendor SK Hynix. The RowHammer attack variant, codenamed Phoenix CVE-2025-6202, CVSS score: 7.1, is capable of bypassing...
CVE-2025-59336: Improper Limitation of a Pathname to a Restricted Directory
Luanox is a module host for Lua packages. Prior to 0.1.1, a file traversal vulnerability can cause potential denial of service by overwriting Phoenix runtime files. Package names like ../../package are not properly filtered and pass the validity check of the rockspec verification system. This...
PT-2025-38061
Name of the Vulnerable Software and Affected Versions: Luanox versions prior to 0.1.1 Description: Luanox is a module host for Lua packages. A file traversal vulnerability can cause a denial of service by overwriting Phoenix runtime files. Package names, such as ../../package, are not properly...
Phoenix: Rowhammer Attacks on DDR5 Memory
Mitigation AMD released updated Platform Initialization PI packages to the Original Equipment Manufacturers OEM for AMD Ryzen™ Series processors. These updates allow customers to enable Mixed Refresh Mode, which is an existing DRAM workaround to rowhammer-style attacks. Please contact your OEM fo...
Malicious code in framework-prompts-phoenix-cressida (npm)
The package framework-prompts-phoenix-cressida was found to contain malicious code...
Malicious code in phoenix-cygnus-forever-fermion (npm)
The package phoenix-cygnus-forever-fermion was found to contain malicious code...
Malicious code in rehype-phoenix-apollo-ceres (npm)
The package rehype-phoenix-apollo-ceres was found to contain malicious code...
Malicious code in technocracy-phoenix-vega-borealis (npm)
The package technocracy-phoenix-vega-borealis was found to contain malicious code...
Malicious code in ursa-phoenix-hadron-terser-webpack-plugin (npm)
The package ursa-phoenix-hadron-terser-webpack-plugin was found to contain malicious code...
Malicious code in phoenix-carina-pipe-dagda (npm)
The package phoenix-carina-pipe-dagda was found to contain malicious code...
Malicious code in phoenix-pipe-whitedwarf-meissa (npm)
The package phoenix-pipe-whitedwarf-meissa was found to contain malicious code...
MAL-2025-44300 Malicious code in framework-prompts-phoenix-cressida (npm)
The package framework-prompts-phoenix-cressida was found to contain malicious code...
MAL-2025-46480 Malicious code in ursa-phoenix-hadron-terser-webpack-plugin (npm)
The package ursa-phoenix-hadron-terser-webpack-plugin was found to contain malicious code...
MAL-2025-45549 Malicious code in phoenix-carina-pipe-dagda (npm)
The package phoenix-carina-pipe-dagda was found to contain malicious code...
MAL-2025-45790 Malicious code in rehype-phoenix-apollo-ceres (npm)
The package rehype-phoenix-apollo-ceres was found to contain malicious code...
MAL-2025-46250 Malicious code in technocracy-phoenix-vega-borealis (npm)
The package technocracy-phoenix-vega-borealis was found to contain malicious code...
MAL-2025-45551 Malicious code in phoenix-pipe-whitedwarf-meissa (npm)
The package phoenix-pipe-whitedwarf-meissa was found to contain malicious code...
MAL-2025-45550 Malicious code in phoenix-cygnus-forever-fermion (npm)
The package phoenix-cygnus-forever-fermion was found to contain malicious code...
CVE-2025-9677 Modo Legend of the Phoenix com.duige.hzw.multilingual AndroidManifest.xml improper export of android application components
A security flaw has been discovered in Modo Legend of the Phoenix up to 1.0.5. The affected element is an unknown function of the file AndroidManifest.xml of the component com.duige.hzw.multilingual. The manipulation results in improper export of android application components. The attack needs t...