MAL-2025-2122 Malicious code in provider-wallet (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ad24f6e17c740bf18547fc420e4f9a54a4fa4c950b1f6ed8ff64a7a243e2bfe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Linux Distros Unpatched Vulnerability : CVE-2015-7546

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The identity service in OpenStack Identity Keystone before 2015.1.3 Kilo and 8.0.x before 8.0.2 Liberty and keystonemiddleware formerly python-keystoneclient...

Linux Distros Unpatched Vulnerability : CVE-2015-5217

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - providers/saml2/admin.py in the Identity Provider IdP server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update the SAML2 Service...

CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20

CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20. A patched version of the package is available...

Azure Entra ID Identity Provider Detected

This is an informational notice that the scanner was able to detect an application using Azure Entra ID. No source data...

Auth0 Identity Provider Detected

This is an informational notice that the scanner was able to detect an application using Auth0 Identity Provider. No source data...

CVE-2025-27414

A flaw was found in MinIO. An incorrect evaluation of the SSH key used in an SFTP connection when using LDAP as an external identity provider with a user with no sshPublicKey property allows an attacker to perform any FTP operations like reading, writing, deleting and listing objects, resulting i...

OESA-2025-1206 ceph security update

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage. Security Fixes: A vulnerability in the Ceph Rados Gateway RadosGW OIDC provider allows attackers to bypass JWT signature verification by...

OESA-2025-1208 ceph security update

Ceph is a massively scalable, open-source, distributed storage system that runs on commodity hardware and delivers object, block and file system storage. Security Fixes: A vulnerability in the Ceph Rados Gateway RadosGW OIDC provider allows attackers to bypass JWT signature verification by...

PT-2025-9136 · Minio · Minio

Name of the Vulnerable Software and Affected Versions: MinIO versions RELEASE.2024-06-06T09-36-42Z through RELEASE.2025-02-28T09-55-16Z Description: A bug in MinIO's evaluation of the trust of the SSH key used in an SFTP connection allows authentication bypass and unauthorized data access. This...

CVE-2025-23046

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth...

Incorrect Implementation of Authentication Algorithm

Overview glpi/glpi is a free Asset and IT Management Software package with ITIL Service Desk, licenses tracking and software auditing. Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to improper validation in the OauthIMAP plugin. If a...

UBUNTU-CVE-2025-23046

GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.18, if a "Mail servers" authentication provider is configured to use an Oauth connection provided by the OauthIMAP plugin, anyone can connect to GLPI using a user name on which an Oauth...

GHSA-7WRW-R4P8-38RX vulnerabilities

Vulnerabilities for packages: memcached-exporter, restic, secrets-store-csi-driver-provider-azure, prometheus-pushgateway, wireguard-go, descheduler, sftpgo-plugin-kms, trillian, nginx-prometheus-exporter, kubernetes-csi-external-attacher, dataplaneapi, ko, kubernetes-dashboard-auth, dive,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, memcached-exporter, newrelic-prometheus-configurator, grype, gcsfuse, aws-flb-cloudwatch, go-licenses, thanos, docker-credential-acr-env, caddy, gops, eksctl, gke-gcloud-auth-plugin, nats, nri-nginx, actions-runner-controller,...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: fuse-overlayfs-snapshotter, memcached-exporter, newrelic-prometheus-configurator, grype, gcsfuse, aws-flb-cloudwatch, go-licenses, thanos, docker-credential-acr-env, caddy, gops, eksctl, gke-gcloud-auth-plugin, nats, nri-nginx, actions-runner-controller,...

AZL-57108 CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...

CVE-2025-24895

CIE.AspNetCore.Authentication is an AspNetCore Remote Authenticator for CIE 3.0. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: 1. Identity Provider IDP: the system that authenticates users and provides identity information SAML affirmation to the...

CVE-2025-24894

SPID.AspNetCore.Authentication is an AspNetCore Remote Authenticator for SPID. Authentication using Spid and CIE is based on the SAML2 standard which provides two entities: Identity Provider IDP: the system that authenticates users and provides identity information SAML affirmation to the Service...

User Impersonation

Overview Affected versions of this package are vulnerable to User Impersonation due to improper validation of SAML response signatures which allows an attacker to inject a malicious, signed XML element as the first signature, bypassing proper verification and enabling impersonation of any SPID or...