MAL-2025-190622 Malicious code in com.unity.xr.visionos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfc5fb97986cf3c32288632dc0df9916994609543b354548885edf9d229dd489 The package com.unity.xr.visionos was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190619 Malicious code in hyatt-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 45791aa99b3cab0aaa98d1564ffb2226c039f7e31723b2b4e6033d482e1ad3d6 The package hyatt-ui was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-190605 Malicious code in airbnb-react-router-legacy-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 64d31fa6c9b6cd0a9e87216ce93110698b49f1fede30d3f090902284a5153613 The package airbnb-react-router-legacy-v3 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-190610 Malicious code in wishlist_dropdown (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 96af5d4cffbd1a2bb13ecd403b9acf5e0fe62f6df151c6b511f556c9c0a11c31 The package wishlistdropdown was found to contain malicious code. Source: ossf-package-analysis...

Amazon Linux 2023 : firefox (ALAS2023-2025-1284)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1284 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks...

GHSA-QJ48-G5CH-7G59 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-gcp, linux-azure...

Amazon Web Services Wickr 安全漏洞

Amazon Web Services Wickr is an end-to-end encryption service from Amazon.com, Inc. A security vulnerability exists in Amazon Web Services Wickr versions prior to 6.62.13 that stems from improper resource release during call termination, which could result in continued receipt of audio input...

Amazon Linux 2023 : lz4, lz4-devel, lz4-libs (ALAS2023-2025-1266)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1266 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks...

Amazon Linux 2 : firefox, --advisory ALAS2FIREFOX-2025-045 (ALASFIREFOX-2025-045)

The version of firefox installed on the remote host is prior to 140.4.0-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2FIREFOX-2025-045 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version numbe...

MAL-2025-190595 Malicious code in @ra-ide/st-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49ae7d07061ce406d972052f23649e631bb22f724cd85c8ab0c73b18689ecb36 The package @ra-ide/st-frontend was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-190592 Malicious code in @ra-ide/ld-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aec551eb9431424b0e79cb127427880ebd5c21b9deb2b8d4a378fb650fb45a84 The package @ra-ide/ld-frontend was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-190586 Malicious code in identity-authn-core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db734e79e178dd70b53bb814581620da1604a06da4967555160d7dfd0d14e0c5 The package identity-authn-core-ui was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-10702

Improper Control of Generation of Code 'Code Injection' vulnerability in Progress DataDirect Connect for JDBC drivers, Progress DataDirect Open Access JDBC driver and Hybrid Data Pipeline allows Remote Code Inclusion. The SpyAttribute connection option implemented by the DataDirect Connect for JD...

MAL-2025-190574 Malicious code in kc-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32088d023faff39ca532f60b6fefa143e98da4ff439ecf1d9922cbb7f5f669ef The package kc-next was found to contain malicious code. Source: ghsa-malware 750f8ce90382db0d1c42cc21bef3cce0f5220048311c62bff8fb2928e2b936c6 Any...

OPENSUSE-SU-2025:15744-1 amazon-ssm-agent-3.3.3270.0-2.1 on GA media

These are all security issues fixed in the amazon-ssm-agent-3.3.3270.0-2.1 package on the GA media of openSUSE Tumbleweed...

MAL-2025-191686 Malicious code in aws-enumerateiam (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c108190780b32337fdce8748948935ac4229f0236710653f363b80a95dfbcd17 Before creating the boto3 client, package exfiltrates user's credentials. In this version, the exfiltrating is masked as connecting to an AWS component. The UR...

AWS Resources MCP Server 安全漏洞

AWS Resources MCP Server is a Python-based MCP server by Bary Huang Personal Developer. A security vulnerability exists in AWS Resources MCP Server version 0.1.0, which stems from insufficient input validation of the executequery method and could lead to remote code execution and AWS credential...

PT-2025-47332

Name of the Vulnerable Software and Affected Versions baryhuang/mcp-server-aws-resources-python version 0.1.0 Description A code injection issue exists due to insufficient input validation in the execute query method. This allows for remote code execution by exposing dangerous Python built-in...

CVE-2025-63604

A code injection vulnerability exists in baryhuang/mcp-server-aws-resources-python 0.1.0 that allows remote code execution through insufficient input validation in the executequery method. The vulnerability stems from the exposure of dangerous Python built-in functions import, getattr, hasattr in...

Linux Distros Unpatched Vulnerability : CVE-2025-65073

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenStack Keystone before 26.0.1, 27.0.0, and 28.0.0 allows a /v3/ec2tokens or /v3/s3tokens request with a valid AWS Signature to provide Keystone authorization...