Malicious code in amazon-chime-sdk-js-exp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 41b8665f77f2bb83789c04cdd6973e2525d3af8609a0e4fc6f41e7b460eb1b51 The OpenSSF Package Analysis project identified 'amazon-chime-sdk-js-exp' @ 10.10.100 npm as malicious. It is considered malicious because: - Th...

MAL-2025-3376 Malicious code in amazon-chime-sdk-js-exp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 41b8665f77f2bb83789c04cdd6973e2525d3af8609a0e4fc6f41e7b460eb1b51 The OpenSSF Package Analysis project identified 'amazon-chime-sdk-js-exp' @ 10.10.100 npm as malicious. It is considered malicious because: - Th...

CVE-2025-3857

When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition tha...

CVE-2025-39431

Cross-Site Request Forgery CSRF vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue affects Amazon Showcase WordPress Plugin: from n/a through = 2.2...

CVE-2025-46506

Cross-Site Request Forgery CSRF vulnerability in Lora77 WpZon – Amazon Affiliate Plugin wpzon allows Reflected XSS.This issue affects WpZon – Amazon Affiliate Plugin: from n/a through = 1.3...

CVE-2025-46506

CVE-2025-46506 describes a CSRF-to-Reflected XSS in the WordPress plugin WpZon – Amazon Affiliate Plugin (versions

USN-7462-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - GPU drivers; - Network drivers; - File systems infrastructure; - Ext4 file system; - Network file system NFS server...

PT-2025-17812 · WordPress · Wpzon – Amazon Affiliate Plugin

Name of the Vulnerable Software and Affected Versions: WpZon – Amazon Affiliate Plugin versions 1.3 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Reflected XSS. Recommendations: For versions 1.3 and earlier, update to a version that contains a f...

WordPress plugin WpZon – Amazon Affiliate Plugin 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery...

USN-7451-1: Linux kernel vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - MIPS architecture; - PowerPC architecture; - RISC-V architecture; - S390 architecture; - Supe...

Amazon Linux AMI : golang (ALAS-2025-1971)

The version of golang installed on the remote host is prior to 1.23.7-1.50. It is, therefore, affected by a vulnerability as referenced in the ALAS-2025-1971 advisory. Calling Decoder.Decode on a message which contains deeply nested structures can cause a panic due to stack exhaustion. This is a...

Amazon Linux AMI : kernel (ALAS-2025-1970)

The version of kernel installed on the remote host is prior to 4.14.355-196.618. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2025-1970 advisory. In the Linux kernel, the following vulnerability has been resolved: block, bfq: don't move oombfqq CVE-2022-49179 I...

Infinite loop condition in Amazon.IonDotnet

Summary Amazon.IonDotnet ion-dotnet is a .NET library with an implementation of the Ion data serialization format. An issue exists in Amazon.IonDotnet and the RawBinaryReader class where, under certain conditions, an actor could trigger an infinite loop condition. Impact When reading binary Ion...

CVE-2025-3857

When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition tha...

CVE-2025-3857 Infinite loop condition in Amazon.IonDotnet

When reading binary Ion data through Amazon.IonDotnet using the RawBinaryReader class, Amazon.IonDotnet does not check the number of bytes read from the underlying stream while deserializing the binary format. If the Ion data is malformed or truncated, this triggers an infinite loop condition tha...

Infinite loop condition in Amazon.IonDotnet

Amazon.IonDotnet ion-dotnet is a .NET library with an implementation of the Ion data serialization format. An issue exists in Amazon.IonDotnet and the RawBinaryReader class where, under certain conditions, an actor could trigger an infinite loop condition...

CVE-2025-39431

Cross-Site Request Forgery CSRF vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue affects Amazon Showcase WordPress Plugin: from n/a through = 2.2...

CVE-2025-39431 WordPress Amazon Showcase WordPress Plugin plugin <= 2.2 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue affects Amazon Showcase WordPress Plugin: from n/a through = 2.2...

CVE-2025-39431 WordPress Amazon Showcase WordPress Plugin plugin <= 2.2 - CSRF to XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Aaron Forgue Amazon Showcase WordPress Plugin amazon-showcase-wordpress-widget allows Stored XSS.This issue affects Amazon Showcase WordPress Plugin: from n/a through = 2.2...

CVE-2025-39431

CVE-2025-39431 : Cross-Site Request Forgery (CSRF) leading to Stored XSS in the Amazon Showcase WordPress Plugin. Affected: Amazon Showcase WordPress Plugin versions n/a through 2.2. Root cause/impact are described in multiple sources (NVD, CVE records, Red Hat) as CSRF enabling XSS; exploitation...