CVE-2025-58435

Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop...

CVE-2025-58435 Open OnDemand didn't rotate password for VNC batch_connect

Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop...

CVE-2025-58435 Open OnDemand didn't rotate password for VNC batch_connect

Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop...

CVE-2025-58435 Open OnDemand didn't rotate password for VNC batch_connect

Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password when TurboVNC was higher than version 3.1.2. The likelihood of exploitation is low as a user would need to share their link to an active desktop...

Malicious code in prebid.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eef953008eb973c33cf8b72ff438a35d772797bcc989e0d909db32655f30615d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ome-api (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 813109d74c2326a2f6ec2d8189b807fcde2654e778172aef8555defeb27fc4a8 Any computer that has this package installed or running should be considered...

Malicious code in service-config-endpoint-provider (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0879016c96750d8d2a0320e43955954e5f07cd7685cd65103101b1b9d3c3d7e5 Any computer that has this package installed or running should be considered...

Malicious code in hrpq1wq123 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1723d1a69b33a9e203de3ca455da66ce2a37a8e1b6a65edc18c77634d2c22ae2 Any computer that has this package installed or running should be considered...

MAL-2025-47069 Malicious code in hrpqwq123 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2cebbda0574f9d3ae88ca29a1cb1e361c27a4fed067d19a24250e692a54bb8d8 Any computer that has this package installed or running should be considered...

Open OnDemand 安全漏洞

Open OnDemand is an open source implementation of Open Interactive HPC over the Web from Ohio Supercomputer Center. A security vulnerability exists in Open OnDemand versions prior to 3.1.15 and 4.0.7, which stems from improper password rotation and could lead to session hijacking...

PT-2025-36938

Name of the Vulnerable Software and Affected Versions: Open OnDemand versions prior to 3.1.15 Open OnDemand versions prior to 4.0.7 Description: Open OnDemand is an open-source HPC portal. Prior to versions 3.1.15 and 4.0.7, noVNC interactive applications did not correctly rotate the password whe...

MAL-2025-46984 Malicious code in proto-tinker-wc (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7c28102f10f0e7abdda4eaae50e9db8edf27c3b15fe2ba6841ceb95fa907adc Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-46983 Malicious code in wrap-ansi (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e58bb76dd73218635e5f6badd1c9693b827a8eb1be48d0bac75d6f8f85d4b53 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-46966 Malicious code in ansi-regex (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2777701ac1bf8726f2ea353b404c7d765ea3eb7bf0506207db828590ade1bf6e Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in ansi-styles (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f82dc187071d265457effc48cb50c7ac209143e5da1a502a633a1c35b88aac67 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in color-string (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f96d7c74748e121e50b19198355b3f8f9f8ba84bcfd1731896fcf4b9ebc76370 Any computer that has this package installed or running should be considered fully compromised. All...

Malicious code in debug (npm)

The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 558d1dda312e85212121f4ed15340349f780f5e40d6685c3687648bbb2924381 Any computer that has this package installed or running should be considered fully compromised. All...

MAL-2025-42146 Malicious code in rtk-wake (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fc493187ac88a35f426edb64ab97f58fcd188ce208058c832d5bd05143ec899 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in newrelic-infrastructure (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc689df21770af17a368dc724b21526759afb6d21614e0f7eb0033ef0ce430ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Evope 1.1.3.20 Hardcoded Cryptographic Key

The component Evope Core in Evope version 1.1.3.20 uses a hardcoded cryptographic key, which means that encryption/decryption keys are permanently embedded in the source code, rather than being securely managed. This creates a critical security flaw because anyone who gains access to or...