Malicious code in poglymer-ognagh-agami (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ed3dc824c97cba51a6577d26475c1181d301514adf2103cd5a18faf9f64d38d2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

DRUPAL-CORE-2025-005

Drupal Core has a rarely used feature, provided by an underlying library, which allows certain attributes of incoming HTTP requests to be overridden. This functionality can be abused in a way that may cause Drupal to cache response data that it should not. This can lead to legitimate requests...

MAL-2025-170814 Malicious code in ameerhussain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45696d279943f3b0ff78a49914b278c0254b8c9d27e1237fcc988f64dbccd7f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MGASA-2025-0273 Updated unbound packages fix security vulnerability

Several multi-vendor cache poisoning vulnerabilities have been discovered in caching resolvers for non-DNSSEC protected data. Unbound is vulnerable for some of these cases that could lead to domain hijacking CVE-2025-11411...

Updated unbound packages fix security vulnerability

Several multi-vendor cache poisoning vulnerabilities have been discovered in caching resolvers for non-DNSSEC protected data. Unbound is vulnerable for some of these cases that could lead to domain hijacking CVE-2025-11411...

Malicious code in kentung-31 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 313dc870bbcc127da90f60c40c356d8b6328e80fde07d2c421b6a78303f8e501 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-163173 Malicious code in nokire-nana21 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e0533514fbd11d87c736b95cf2e7a103c658f80b43f0b2f49586d16438a2e324 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-162223 Malicious code in nokire-akaza12 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector da7b11f5d19f38aebb9b11b77829cc1f297913720313c772afe3c89584bdedd9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

USN-7836-2: Bind vulnerabilities

USN-7836-1 fixed vulnerabilities in Bind. This update provides the corresponding fixes for Ubuntu 20.04 LTS. Original advisory details: Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to...

USN-7836-2 bind9 vulnerabilities

USN-7836-1 fixed vulnerabilities in Bind. This update provides the corresponding fixes for Ubuntu 20.04 LTS. Original advisory details: Zuyao Xu and Xiang Li discovered that Bind incorrectly handled certain malformed DNSKEY records. A remote attacker could possibly use this issue to cause Bind to...

Important: Red Hat Security Advisory: bind security update

An update for bind is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

bind: Cache poisoning due to weak PRNG

A vulnerability was found in BIND resolvers caused by a weakness in the Pseudo Random Number Generator PRNG. This weakness allows an attacker to potentially predict the source port and query ID used by BIND, enabling cache poisoning attacks. If successful, the attacker can inject malicious DNS...

bind: Cache poisoning attacks with unsolicited RRs

A vulnerability exists in BIND’s DNS resolver logic that makes it overly permissive when accepting resource records RRs in responses. Under certain conditions, this flaw allows attackers to inject unsolicited or forged DNS records into the cache. This can be exploited to poison the resolver cache...

bind: Cache poisoning due to weak PRNG

A vulnerability was found in BIND resolvers caused by a weakness in the Pseudo Random Number Generator PRNG. This weakness allows an attacker to potentially predict the source port and query ID used by BIND, enabling cache poisoning attacks. If successful, the attacker can inject malicious DNS...

Important: Red Hat Security Advisory: bind9.18 security update

An update for bind9.18 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...

MAL-2025-149118 Malicious code in venus-parcel-markdown-pdf-pulsar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21d77e33fa6ab5a9f2a3b96a855635c489b92850c24dbce745e25844b9ea32b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148552 Malicious code in terser-webpack-plugin-foundation-less-subscription (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c15839f0d43950e7017ec6478f3d5043f812bc56814c15fb3687c2a636ce3446 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-142700 Malicious code in frontend-carpo-yaml-hyperion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47cc2702bf536ac942f0062c5a6c776da5fc9a135b93382df362258e62dbb975 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-141793 Malicious code in draco-hapi-luna-gravity (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f43ca38f4a170173c94afac1558333ea2d8020e9a3392cf0aadf92300b6959d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...