4532 matches found
MAL-2025-189214 Malicious code in rest-oortcloud-interstellarmedium-yaml (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f490d6f037ba5aba42fdaf960b0d8bbe6e55f94782153789b5b8d489e6eca4cc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176062
Malicious code in tardigrade-virgo-hologram-yaml npm...
MAL-2025-186002 Malicious code in capella-yaml-innercore-hermes (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 372f99cb9ed94cef8bc325e39ea217a894b8578a523b5ea09806bdeb8df4ca2a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-190013 Malicious code in try-stub-yaml-query-awk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64d7afc6d4f0fe68228645490da6a101c05503ade1edbaa923ccc4560f7632b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
JS-YAML 安全漏洞
JS-YAML is a JavaScript YAML parser and dump from Nodeca Open Source. A security vulnerability exists in JS-YAML version 4.1.0 and earlier, which stems from the possibility of modifying prototypes when parsing YAML documents, potentially leading to prototype contamination...
PT-2025-46851
Name of the Vulnerable Software and Affected Versions js-yaml versions prior to 4.1.1 Description js-yaml is a JavaScript YAML parser and dumper. A flaw exists where an attacker can alter the prototype of a parsed YAML document, leading to prototype pollution. This impacts users parsing untrusted...
Mageia: Security Advisory (MGASA-2025-0275)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
Linux Distros Unpatched Vulnerability : CVE-2025-64718
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a...
Updated perl-YAML-LibYAML packages fix security vulnerability
YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified. CVE-2025-40908...
MGASA-2025-0275 Updated perl-YAML-LibYAML packages fix security vulnerability
YAML-LibYAML prior to 0.903.0 for Perl uses 2-args open, allowing existing files to be modified. CVE-2025-40908...
Security Bulletin: Multiple Vulnerabilities in IBM API Connect
Summary Multiple vulnerabilities were addressed in IBM API Connect version 10.0.8.5 Vulnerability Details CVEID:CVE-2020-36732 DESCRIPTION: The crypto-js package before 3.2.1 for Node.js generates random numbers by concatenating the string "0." with an integer, which makes the output more...
EUVD-2025-116476
Malicious code in async-hugo-yaml-rimraf npm...
EUVD-2025-123918
Malicious code in pavo-mongoose-yaml-development npm...
EUVD-2025-113777
Malicious code in event-yaml-scorpius-ora npm...
EUVD-2025-120148
Malicious code in yaml-arcturus-postgres-jabbah npm...
EUVD-2025-111755
Malicious code in levels-npm-yaml-xanadu npm...
EUVD-2025-121099
Malicious code in triton-taurus-callisto-yaml npm...
EUVD-2025-122728
Malicious code in rehype-yaml-tailwindcss-levels npm...
Malicious code in yaml-foundation-antares-zenith (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0a67ec3a64d3a7650a12669ab6c5ae42927f3b82e08b118029fad105f67d844 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...