MAL-2025-146170 Malicious code in phoebe-pipe-repository-spectron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5e5e991ebc3e6935e559da0f12e7cd8d6efbb7868d545cd595a7f3e7aee0ddf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-144825 Malicious code in meissa-pipe-dependencies-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46d83ca74cc580cbd8d76790318201e0cdecf41986d97cbcec98d9b091d4ea57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146144 Malicious code in phoebe-centaurus-pipe-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a3a8c18f7ac238f1acacd09802476e050fd2c967e0bf88d0d81b6c9e94639a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146205 Malicious code in phoenix-pipe-subscription-helios (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ce4d42780a7001aa44f3c101823bdbcade9d30f0ca76707a7e229a9f1072c0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check

In the Linux kernel, the following vulnerability has been resolved: HID: hid-thrustmaster: Fix warning in thrustmasterprobe by adding endpoint check syzbot has found a type mismatch between a USB pipe and the transfer endpoint, which is triggered by the hid-thrustmaster driver1. There is a number...

Botan C++ Crypto Algorithms Library 3.10.0

Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS 10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990479 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5piperelease when deadlock is detected mdp5getglobalstate...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990469)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990469 advisory. In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix struct clk leak on probe errors Make sure to release the pipe clock reference ...

CVE-2025-12683

The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalationonly if chained...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989587)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989587 advisory. In the Linux kernel, the following vulnerability has been resolved: can: mcbausb: properly check endpoint type Syzbot reported warning in usbsubmiturb which is cause...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989326)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989326 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Check pipe offset before setting vblank pipectx has a size of MAXPIPES so checki...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989523)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989523 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5piperelease when deadlock is detected mdp5getglobalstate...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989066)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989066 advisory. In the Linux kernel, the following vulnerability has been resolved: drm/msm/mdp5: Return error code in mdp5piperelease when deadlock is detected mdp5getglobalstate...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-989178)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989178 advisory. In the Linux kernel, the following vulnerability has been resolved: phy: qcom-qmp: fix struct clk leak on probe errors Make sure to release the pipe clock reference ...

CVE-2025-12683

The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalationonly if chained...

CVE-2025-12683 NULL DACL assigned to Named Pipe communicating with SYSTEM Service

The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalationonly if chained...

CVE-2025-12683

Summary: CVE-2025-12683 affects the Everything software stack where a service (running as SYSTEM) communicates with the Everything GUI over a named pipe that has a NULL DACL. This configuration grants all users full permissions on the named pipe, enabling potential privilege escalation for a loca...

CVE-2025-12683 NULL DACL assigned to Named Pipe communicating with SYSTEM Service

The service employed by Everything, running as SYSTEM, communicates with the lower privileged Everything GUI via a named pipe. The named pipe has a NULL DACL and thus provides all users full permission over it; leading to potential Service Denial Of Service or Privilege escalationonly if chained...

PT-2025-44963

Name of the Vulnerable Software and Affected Versions Everything affected versions not specified Description The service used by Everything, running with SYSTEM privileges, communicates with the Everything GUI using a named pipe. This named pipe has a NULL Discretionary Access Control List DACL,...

Everything 安全漏洞

Everything is a file search software from Everything open source. A security vulnerability exists in Everything that stems from a named pipe having a NULL DACL, which could lead to a denial-of-service attack or elevation of privilege by a local, low-privileged user...