3831 matches found
CVE-2025-66565
Fiber Utils (github.com/gofiber/utils) has a vulnerability in UUIDv4() and UUID() where crypto/rand.Read() failures trigger silent fallbacks to predictable UUID values, including the zero UUID 00000000-0000-0000-0000-000000000000. This root cause affects versions up to 2.0.0-rc.3; the issue is fi...
PT-2025-49761
Name of the Vulnerable Software and Affected Versions Fiber Utils versions 2.0.0-rc.3 and below Description Fiber Utils is a collection of functions for Fiber. In versions 2.0.0-rc.3 and below, if the system’s cryptographic random number generator crypto/rand fails, the software silently reverts ...
GHSA-M98W-CQP3-QCQR Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values
Summary Critical security vulnerabilities exist in both the UUIDv4 and UUID functions of the github.com/gofiber/utils package. When the system's cryptographic random number generator crypto/rand fails, both functions silently fall back to returning predictable UUID values, the zero UUID...
Update on React Server Components RCE Vulnerability (CVE-2025-55182 / CVE-2025-66478)
The attack landscape has been dynamic following the disclosure of the React Server Components RCE vulnerability. New information has emerged regarding the initial Proof-of-Concept exploit, as well as improved detection methods, exploitation mechanics observed in the wild, and rapidly growing atta...
AZL-72307 CVE-2025-14104 affecting package util-linux for versions less than 2.37.4-10
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...
UBUNTU-CVE-2025-14104
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...
CVE-2025-14104 Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...
EUVD-2025-201450
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...
CVE-2025-14104
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...
CVE-2025-14104 Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...
CVE-2025-14104
CVE-2025-14104 concerns a heap buffer overread in util-linux's setpwnam() when processing 256-byte usernames, affecting SUID login-utils that write to the password database. The vulnerability is exploitable locally with low privileges and can impact availability (high) and confidentiality (low); ...
Arbitrary Code Injection
Overview @modern-js/utils is a progressive web framework based on React. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe deserialization of RSC payloads from HTTP requests to Server Function endpoints. An unauthenticated attacker can execute arbitrary code ...
RUSTSEC-2025-0145 `uniswap-utils` was removed from crates.io for malicious code
It depended on the evm-units crate, which appeared to be attempting to steal cryptocurrency...
`uniswap-utils` was removed from crates.io for malicious code
It depended on the evm-units crate, which appeared to be attempting to steal cryptocurrency...
Oracle Linux 10 : ELSA-2025-20145-0: / shadow-utils (ELSA-2025-201450)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-201450 advisory. 2:4.15.0-8 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-93172 Tenable has extracted the preceding description block directly from...
RLSA-2025:20145 Low: shadow-utils security update
The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fixes: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 For...
shadow-utils security update
An update is available for shadow-utils. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The shadow-utils packages include programs for converting UNIX password...
keras-utilities (>=0.1.7, <=0.1.27) potentially affected by CVE-2025-12060 via keras (1.2.1)
keras PYPI version 1.2.1 is affected by a known vulnerability. The following packages have a transitive dependency on keras and may be impacted: - keras-utilities =0.1.7, =0.1.27 Source cves: CVE-2025-12060 Source advisory: OSV:GHSA-HJQC-JX6G-RWP9...
RockyLinux 10 : shadow-utils (RLSA-2025:20145)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:20145 advisory. shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 Tenable has extracted the preceding description...