infinispan: Credential Leakage in Infinispan CLI

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found...

Malicious code in tools-component-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8430b3270cb2769c8afa5686cc7ed09d5be1fe3a5d680fd3887e3b2a1279e3f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5514 Malicious code in os-info-es6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5db90325052a54f4806fa3551b5830ecb62ee7544dff34a58a48549719bf266 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5367 Malicious code in bg-core-payments-automation (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7f31e4b1f7d92e4d7eb25476cf6041e8360ea7a50a002ab1311b3629f34c0f8 Any computer that has this package installed or running should be considered...

Malicious code in viryc-hsc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c7e65fbc4460da9aef8938e77b5ffc7aeb72d879e43d1062a2ebc211d39eed5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nava-clone (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74fb4caf6f9420831f8001a0382c3a357186529a0cf6e822e884eeaa90182ac3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-pkg-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6df8ca0c98ea357d77cecd453a9b679670af19bad2830fd82ee7cc85813b239c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5490 Malicious code in canvas-chache-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53cd51cc0d4949d913a5bc2368bc95601e8e8402591ad46084396646e4f75149 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Sensitive Data Exposure

Infinispan CLI is vulnerable to sensitive data exposure. The vulnerability is due to processing a Base64-decoded Kubernetes secret password in plaintext and including it in a command string, which may expose the data in error messages when a command is not found, allowing attackers to exploit thi...

MAL-2025-5371 Malicious code in byaziine_validator (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f12a2c76230f3f02e4f5f0e1b7124c3fcdafddd9b28e6083e61b3c2a92f96eb Any computer that has this package installed or running should be considered...

Malicious code in workflows-templates (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9c885607af191f5acc692b6c3050cc0bbdf52d98ab543e79cef7d32387e247d Any computer that has this package installed or running should be considered...

Malicious code in smart-attachments (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7c36907a46d56559df062e1afb7ca8644198d352f1a8b43e59c60cad5da43ea Any computer that has this package installed or running should be considered...

Malicious code in maybe-i-would-like-a-banana (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 662fcbfd490d5409f2a17a156785c7d82b81e2c57e0c67d1ae701ccf49fff1b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-CQM8-RG2P-JFCF Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found...

Infinispan CLI vulnerable to Generation of Error Message Containing Sensitive Information

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found...

📄 Mouselink 5.0.1 Unauthenticated Remote Code Execution

Mouselink version 5.0.1 allows unauthenticated remote code execution due to improper JWT validation, enabling attackers to forge JWT tokens with a known hardcoded secret. Using the forged token, attackers can bypass authentication, connect to the WebSocket interface, and simulate keyboard input t...

CVE-2025-5731

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found...

CVE-2025-5731 Infinispan: credential leakage in infinispan cli

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found...

CVE-2025-5731 Infinispan: credential leakage in infinispan cli

A flaw was found in Infinispan CLI. A sensitive password, decoded from a Base64-encoded Kubernetes secret, is processed in plaintext and included in a command string that may expose the data in an error message when a command is not found...

CVE-2025-5731

Summary: CVE-2025-5731 affects the Infinispan CLI, where a credential decoded from a Kubernetes secret is handled in plaintext and can appear in a command string, potentially leaking data in an error message when a command is not found. Root cause: insecure processing/embedding of the decoded sec...