Malicious code in sensort-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da08217a79ac25925bb75373056d29208390b88fa6a4e75d27f6c5889b5a4943 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2705 Malicious code in sensort-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da08217a79ac25925bb75373056d29208390b88fa6a4e75d27f6c5889b5a4943 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2644 Malicious code in asset_cli_tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 56eaa865141139174bfeca87a7ab5f743c5025167bf539b16b8688232094d479 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OPENSUSE-SU-2025:14921-1 argocd-cli-2.14.8-1.1 on GA media

These are all security issues fixed in the argocd-cli-2.14.8-1.1 package on the GA media of openSUSE Tumbleweed...

NetScaler: How to update AppFirewall signature from CLI

NetScaler: How to update AppFirewall signature from CLI...

Exploit for Path Traversal in Jenkins

CVE-2024-23897 Jenkins RCE Arbitrary File Read CVE-2024-2389...

AZL-77493 CVE-2025-30204 affecting package cf-cli for versions less than 8.4.0-27

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AZL-77498 CVE-2025-30204 affecting package dcos-cli for versions less than 1.2.0-21

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AZL-77496 CVE-2025-30204 affecting package dcos-cli for versions less than 1.2.0-24

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

Summary The AWS Cloud Development Kit AWS CDK 1 is an open-source software development framework for defining cloud infrastructure in code and provisioning it through AWS CloudFormation. The AWS CDK CLI 2 is a command line tool for interacting with CDK applications. Customers can use the CDK CLI ...

CVE-2025-2598 AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

When the AWS Cloud Development Kit AWS CDK Command Line Interface AWS CDK CLI is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178....

CVE-2025-2598 AWS CDK CLI prints AWS credentials retrieved by custom credential plugins

When the AWS Cloud Development Kit AWS CDK Command Line Interface AWS CDK CLI is used with a credential plugin which returns an expiration property with the retrieved AWS credentials, the credentials are printed to the console output. To mitigate this issue, users should upgrade to version 2.178....

Ubuntu: Security Advisory (USN-7362-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Relative Path Traversal

Overview polyaxon is a Command Line Interface CLI and client to interact with Polyaxon API. Affected versions of this package are vulnerable to Relative Path Traversal enabling the deletion of files on the target server. An attacker can delete critical files such as polyaxon.sock to cause a crash...

Cross-site Request Forgery (CSRF)

Overview polyaxon is a Command Line Interface CLI and client to interact with Polyaxon API. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the create endpoint. An attacker who can convince a user to follow a malicious link can cause the creation of a...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: opa, kargo, melange, kots, trivy, eksctl, wolfictl, buildkitd, spegel, zarf, helm, linkerd2, cluster-api-helm-controller, helm-operator, k8ssandra-client, flux-source-controller, flux-helm-controller, kaniko, opa-envoy, docker-compose, chartmuseum, k8sgpt, ctop, k3s,...

Azure Linux 3.0 Security Update: cert-manager / containerd / containerd2 / containerized-data-importer / dcos-cli / influxdb (CVE-2025-27144)

The version of cert-manager / containerd / containerd2 / containerized-data-importer / dcos-cli / influxdb installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-27144 advisory. - Go JOSE provides an...

CVE-2025-2398

A vulnerability was found in China Mobile P22g-CIac, ZXWT-MIG-P4G4V, ZXWT-MIG-P8G8V, GT3200-4G4P and GT3200-8G8P up to 20250305. It has been rated as critical. This issue affects some unknown processing of the component CLI su Command Handler. The manipulation leads to use of default credentials...

CVE-2024-54027

A Use of Hard-coded Cryptographic Key vulnerability CWE-321 in FortiSandbox version 4.4.6 and below, version 4.2.7 and below, version 4.0.5 and below, version 3.2.4 and below, version 3.1.5 and below, version 3.0.7 to 3.0.5 may allow a privileged attacker with super-admin profile and CLI access t...

GHSA-265R-HFXG-FHMG vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, cert-manager-cmctl, trivy-fips, k8ssandra-client-fips, docker-compose, docker-fips, k3s, k8ssandra-client, beats-fips, cilium-cli, docker-cli-buildx-fips, kaniko, envoy-gateway-fips, cert-manager-cmctl-fips, osv-scanner, buildkitd, beats,...