SUSE CVE-2025-59432

SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals...

Malicious Package

Overview asyncprintln is a malicious package. Two malicious Rust crates, fasterlog impersonates the legitimate fastlog library and asyncprintln attempt to scan source files for Quoted Ethereum private keys 0x + 64 hex, Solana-style Base58 secrets and Bracketed byte arrays to later exfiltrate...

Malicious code in iconfont-icons (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b7bb9c2f9da72d5f2921c8a1f5f168c03307649d8ed230ea031fde029d890c0 Any computer that has this package installed or running should be considered...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

Malicious code in vite-plugin-parse-json (npm)

The package vite-plugin-parse-json was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4013d2b27a0c8568a2b51161431838d7877caf18d55e179597d06e162989b484 Any computer that has this package installed or running should be considered full...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

podman: Podman kube play command may overwrite host files

There's a vulnerability in podman where an attacker may use the kube play command to overwrite host files when the kube file container a Secrete or a ConfigMap volume mount and such volume contains a symbolic link to a host file path. In a successful attack, the attacker can only control the targ...

Malicious code in fezbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ced7d3b77fec12a874f274f33a417e27bbf21e58f9dfe01e15c734c92286dbc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-59432

SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals...

CVE-2025-59434 Critical Multi-Tenant Variable Disclosure in Flowise Cloud via Custom JavaScript Function

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to August 2025 Cloud-Hosted Flowise, an authenticated vulnerability in Flowise Cloud allows any user on the free tier to access sensitive environment variables from other tenants via the Custom JavaScri...

CVE-2025-59432

SCRAM timing attack (CVE-2025-59432) affects the SCRAM Java implementation prior to v3.2 due to using Arrays.equals to compare secret values, causing variable execution time. It can enable a timing side‑channel to infer authentication material. The issue is mitigated by using constant-time compar...

CVE-2025-59432

SCRAM Salted Challenge Response Authentication Mechanism is part of the family of Simple Authentication and Security Layer SASL, RFC 4422 authentication mechanisms. Prior to version 3.2, a timing attack vulnerability exists in the SCRAM Java implementation. The issue arises because Arrays.equals...

MAL-2025-47507 Malicious code in vite-jsconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f03bb7808458e6fe8226e85f4870698a47c60f6b846bd9f95283b27800b215ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47501 Malicious code in tailwind-cup-icon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b63b6f29071fd3e01046c19dd01c0f863e62d3c2fd92a1f51d040e5f06ec839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47497 Malicious code in some-promise (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3558d5270ba6945f13c577df7f903f2e449b54435c6aa2ee46d721ef5e9ea198 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47496 Malicious code in recharts-smart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c4ceccc5b595b8382c50ef249896ff0ebe9b299b3791bc7a7c5f90ec2f5481d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47491 Malicious code in postcss-calc-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a126d37fa7524804ef4c161588d71e9837418138fd67c7fbd8bc775d0f78a49f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47475 Malicious code in cui-travel-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 28f2686ec4318061b35e9018872a2a9f3a364c77dcf26ccc1bc405d36475d8fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-device-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 113702b97f378bfde6af287d00821b1e3ebec6cfa164e3d263f57632210869c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...