Amazon Linux 2023 : containerd, containerd-stress (ALAS2023-2025-1272)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1272 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Amazon Linux 2 : qt5-qt3d, --advisory ALAS2-2025-3074 (ALAS-2025-3074)

The version of qt5-qt3d installed on the remote host is prior to 5.15.3-1. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3074 advisory. A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile o...

Amazon Linux 2023 : nerdctl (ALAS2023-2025-1259)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1259 advisory. go-viper's mapstructure May Leak Sensitive Information in Logs When Processing Malformed Data CVE-2025-11065 Tenable has extracted the preceding description block directly from the tested product...

Amazon Linux 2 : amazon-efs-utils, --advisory ALAS2-2025-3076 (ALAS-2025-3076)

The version of amazon-efs-utils installed on the remote host is prior to 2.4.0-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2025-3076 advisory. regex is an implementation of regular expressions for the Rust language. The regex crate features built-in...

Amazon Linux 2023 : xmlunit, xmlunit-assertj, xmlunit-core (ALAS2023-2025-1260)

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2025-1260 advisory. XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet used for an XSLT transformation, because XSLT extension functions are enabled...

Amazon Linux 2 : tomcat, --advisory ALAS2-2025-3067 (ALAS-2025-3067)

The version of tomcat installed on the remote host is prior to 7.0.76-10. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2025-3067 advisory. Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred including exceeding limits during the...

Amazon Linux 2 : amazon-ecr-credential-helper, --advisory ALAS2ECS-2025-078 (ALASECS-2025-078)

The version of amazon-ecr-credential-helper installed on the remote host is prior to 0.10.1-3. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2ECS-2025-078 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values...

Amazon Linux 2023 : runfinch-finch (ALAS2023-2025-1270)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1270 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

Amazon Linux 2023 : tomcat9, tomcat9-admin-webapps, tomcat9-el-3.0-api (ALAS2023-2025-1281)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1281 advisory. Relative Path Traversal vulnerability in Apache Tomcat. The fix for bug 60013 introduced a regression where the rewritten URL was normalized before it was decoded. This introduced the...

Amazon Linux 2 : containerd, --advisory ALAS2DOCKER-2025-082 (ALASDOCKER-2025-082)

The version of containerd installed on the remote host is prior to 2.1.4-1. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2DOCKER-2025-082 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6...

Amazon Linux 2023 : amazon-ecr-credential-helper (ALAS2023-2025-1271)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2025-1271 advisory. net/url: insufficient validation of bracketed IPv6 hostnames The Parse function permitted values other than IPv6 addresses to be included in square brackets within the host component of a URL...

CVE-2025-12967

An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rdssuperuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service RDS users. We recommend customers...

CVE-2025-12967

An issue in AWS Wrappers for Amazon Aurora PostgreSQL may allow for privilege escalation to rdssuperuser role. A low privilege authenticated user can create a crafted function that could be executed with permissions of other Amazon Relational Database Service RDS users. We recommend customers...

Malicious code in initial_hornet_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1940f91dae4901da23794377633f243659eec2a20405ef736fd11bf81a539682 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in alternative_badger_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f081ddc2652248216769a80be5bd83ae745550db3365fae0e56d1ad87eb7de70 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in democratic_capybara_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0adc73a2b067dce0c7ef34b7d16f7b8eaef2eaa773d3aeab90e83673672f2488 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60448 Malicious code in famous_hippopotamus_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7172fc9913c7f7dda338a859b27a1e2b60b5a1ffa47a7017f266ac19070d3b46 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mature_centipede_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e84956a4c43cd2918baa4d0666d9075d8eb8dc52dc67e7e90c5572d87360c03f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in legal_heron_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01312ce313b035f7407e8d7de4438088181514ebab7b29fa0bc45d897bed7726 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fantastic_lion_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 827b8da7bb445180ad6f2680a5557be9f3dfddf8c92f8cf40824dbfe4e312d32 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...