MAL-2025-191466 Malicious code in rpc-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eca28ab1eabeac24c0ce55063ac151338d0255fcc2c8f74909566c8c3a3a8b1f The package rpc-validator was found to contain malicious code. Source: ghsa-malware 318ca2489ffa297599695ecb6b29c76c63bb61b59d5380b1092213774438e35d...

CVE-2025-62703: Deserialization of Untrusted Data

Fugue is a unified interface for distributed computing that lets users execute Python, Pandas, and SQL code on Spark, Dask, and Ray with minimal rewrites. In version 0.9.2 and prior, there is a remote code execution vulnerability by pickle deserialization via FlaskRPCServer. The Fugue framework...

fugue 代码问题漏洞

fugue is an open source unified interface for distributed computing by The Fugue Project. A code issue vulnerability exists in fugue 0.9.2 and earlier versions, which stems from FlaskRPCServer remote code execution via pickle deserialization...

Security Bulletin: Multiple Security Vulnerabilities in IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2023-32731 CVE-2023-32732)

Summary IBM Sterling B2B Integrator and IBM Sterling File Gateway have addressed the security vulnerabilities Vulnerability Details CVEID:CVE-2023-32731 DESCRIPTION: When gRPC HTTP2 stack raised a header size exceeded error, it skipped parsing the rest of the HPACK frame. This caused any HPACK...

TencentOS Server 3: samba (TSSA-2023:0313)

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0313 advisory. Package updates are available for TencentOS Server 3 that fix the following vulnerabilities...

Improper Verification Of Cryptographic Signature

Apache Spark is vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to the use of an unauthenticated default encryption cipher AES/CTR/NoPadding for RPC communication when spark.network.crypto.enabled is true and no cipher is explicitly configured, which allow...

Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-53174)

SUNRPC: The function cshow was called with protection from RCU. This only ensures that cp will not be freed. Therefore, the reference count for cp can drop to zero, which will trigger a refcount use-after-free warning when cacheget is called. This plugin only works with Tenable.ot. Please visit...

EUVD-2025-124954

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdrstreamdecodeopaqueauth, zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gsskrb5verifymicv2...

CVE-2025-40129

CVE-2025-40129 is a Linux kernel vulnerability addressed in Unity Linux/UTSA-2026-013110: sunrpc may dereference checksum.data due to a zero-length checksum in xdr_stream_decode_opaque_auth(), causing a null pointer dereference when gss_krb5_verify_mic_v2() accesses checksum.data. The patch ensur...

CVE-2025-40129

In the Linux kernel, the following vulnerability has been resolved: sunrpc: fix null pointer dereference on zero-length checksum In xdrstreamdecodeopaqueauth, zero-length checksum.len causes checksum.data to be set to NULL. This triggers a NPD when accessing checksum.data in gsskrb5verifymicv2...

kernel: nfs: Clean up /proc/net/rpc/nfs when nfs_fs_proc_net_init() fails

In the Linux kernel, the following vulnerability has been resolved: nfs: Clean up /proc/net/rpc/nfs when nfsfsprocnetinit fails. syzbot reported a warning below 1 following a fault injection in nfsfsprocnetinit. 0 When nfsfsprocnetinit fails, /proc/net/rpc/nfs is not removed. Later, rpcprocexit...

BIT-OPENTELEMETRY-COLLECTOR-2024-36129 OpenTelemetry Collector has a Denial of Service via Zip/Decompression Bomb sent over HTTP or gRPC

The OpenTelemetry Collector offers a vendor-agnostic implementation on how to receive, process and export telemetry data. An unsafe decompression vulnerability allows unauthenticated attackers to crash the collector via excessive memory consumption. OTel Collector version 0.102.1 fixes this issue...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988861)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988861 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svctcplistendataready After the listener svcsock is freed, and before invoking...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990063)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990063 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990278)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990278 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: make sure cache entry active before cacheshow The function cshow was called with protecti...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-989421)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-989421 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix UAF in svctcplistendataready After the listener svcsock is freed, and before invoking...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-990363)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990363 advisory. In the Linux kernel, the following vulnerability has been resolved: nfsd: fix nfs4openowner leak when concurrent nfsd4open occur The action force umountumount -f wil...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988943)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988943 advisory. In the Linux kernel, the following vulnerability has been resolved: NFSv4: Don't hold the layoutget locks across multiple RPC calls When doing layoutget as part of t...

Unity Linux 20.1070a Security Update: kernel (UTSA-2025-988809)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-988809 advisory. In the Linux kernel, the following vulnerability has been resolved: memory: renesas-rpc-if: fix platform-device leak in error path Make sure to free the flash platfo...

Unity Linux 20.1070e Security Update: kernel (UTSA-2025-990032)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2025-990032 advisory. In the Linux kernel, the following vulnerability has been resolved: SUNRPC: Fix RPC client cleaned up the freed pipefs dentries RPC client pipefs dentries cleanup is...