17270 matches found
GHSA-XH9H-692F-MMG4 Withdrawn Advisory: Microsoft Knack ReDoS Vulnerability in the Introspection Module
Withdrawn Advisory This advisory has been withdrawn because the attack surface of this vulnerability is outside of Knack's intended functionality. The maintainer states the following: These CVEs are invalid. Knack is a CLI framework used by Azure CLI. It's a local library, not a web service. In...
DEBIAN-CVE-2025-54364
Microsoft Knack 0.12.0 allows Regular expression Denial of Service ReDoS in the knack.introspection module. optiondescriptions employs an inefficient regular expression pattern: "\s:param\s+.+?\s:." that is susceptible to catastrophic backtracking when processing crafted docstrings containing a...
DEBIAN-CVE-2025-54363
Microsoft Knack 0.12.0 allows Regular expression Denial of Service ReDoS in the knack.introspection module. extractfullsummaryfromsignature employs an inefficient regular expression pattern: "\s:param\s+.+?\s:." that is susceptible to catastrophic backtracking when processing crafted docstrings...
UBUNTU-CVE-2025-54363
Microsoft Knack 0.12.0 allows Regular expression Denial of Service ReDoS in the knack.introspection module. extractfullsummaryfromsignature employs an inefficient regular expression pattern: "\s:param\s+.+?\s:." that is susceptible to catastrophic backtracking when processing crafted docstrings...
CVE-2025-54364: Inefficient Regular Expression Complexity
Microsoft Knack 0.12.0 allows Regular expression Denial of Service ReDoS in the knack.introspection module. optiondescriptions employs an inefficient regular expression pattern: "\s:param\s+.+?\s:." that is susceptible to catastrophic backtracking when processing crafted docstrings containing a...
CVE-2025-54363: Inefficient Regular Expression Complexity
Microsoft Knack 0.12.0 allows Regular expression Denial of Service ReDoS in the knack.introspection module. extractfullsummaryfromsignature employs an inefficient regular expression pattern: "\s:param\s+.+?\s:." that is susceptible to catastrophic backtracking when processing crafted docstrings...
mcp-cli security vulnerability
mcp-cli is a model context protocol checker for Wong2 Personal Developer. A security vulnerability exists in mcp-cli version 1.13.0, which stems from an incorrect operation of the function redirectToAuthorization in the file /src/oauth/provider.js resulting in os command injection...
CVE-2025-9262: Improper Neutralization of Special Elements used in an OS Command
A flaw has been found in wong2 mcp-cli 1.13.0. Affected is the function redirectToAuthorization of the file /src/oauth/provider.js of the component oAuth Handler. This manipulation causes os command injection. The attack may be initiated remotely. The attack is considered to have high complexity...
CVE-2025-8959 vulnerabilities
Vulnerabilities for packages: tflint, zot, zarf, kots, syft, tfsec, terragrunt, wolfictl, rancher-fleet, grype, xeol, conftest, trivy, kubescape, k9s, snyk-cli, steampipe, opentofu, terraform, trivy-operator...
GHSA-WJRX-6529-HCJ3 vulnerabilities
Vulnerabilities for packages: tflint, zot, zarf, kots, syft, tfsec, terragrunt, wolfictl, rancher-fleet, grype, xeol, conftest, trivy, kubescape, k9s, snyk-cli, steampipe, opentofu, terraform, trivy-operator...
CVE-2025-8959 vulnerabilities
Vulnerabilities for packages: terraform, cloudbeat-fips, k9s-fips, opentofu-fips, xeol, cloudbeat, xeol-fips, trivy, trivy-fips, terraform-fips, trivy-operator, grype-fips, grype-db, opentofu, wolfictl, rancher-fleet, conftest, syft-fips, tfsec, trivy-operator-fips, conftest-fips, chainctl,...
data-pipelines-cli (>=0.31.0, <=0.32.0), pytoil (>=0.36.0, <=0.38.1) potentially affected by CVE-2025-55201 via copier (7.0.1)
copier PYPI version 7.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - data-pipelines-cli =0.31.0, =0.36.0, =0.38.1 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...
dialogy (>=0.2.3, <=0.9.20), flexlate-dev (>=0.1.0, <=0.19.0) +2 more potentially affected by CVE-2025-55201 via copier (5.1.0)
copier PYPI version 5.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on copier and may be impacted: - dialogy =0.2.3, =0.1.0, =0.1.0, =0.1.0, =0.2.0 Source cves: CVE-2025-55201 Source advisory: OSV:GHSA-3XW7-V6CJ-5Q8H...
Malware in meid-cli
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in meid-cli (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54a1eca3fe980472cd2c418bc50f361595c86cc248665cdf8e01129e7af96f66 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview meid-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious code in ember-cli-bable (npm)
The package ember-cli-bable was found to contain malicious code...
Malicious code in wepack-cli (npm)
The package wepack-cli was found to contain malicious code...