Malicious code in trace-mapping (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-5310

Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework TCF interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution...

CVE-2025-6521

During the initial setup of the device the user connects to an access point broadcast by the Sight Bulb Pro. During the negotiation, AES Encryption keys are passed in cleartext. If captured, an attacker may be able to decrypt communications between the management app and the Sight Bulb Pro which...

Malicious code in dynatrace-test-automation (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74e3306bb8dffcb52855ae4c1db02c52669e3f7aa823b0baf1c10f781b90ab77 Any computer that has this package installed or running should be considered...

Malicious code in assets-atlas-editor (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f270720b1154e7b5c4a4300f1817bc922d5e372148d26a57b4b9d0c8ee3d95b Any computer that has this package installed or running should be considered...

MAL-2025-5470 Malicious code in umd-package (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ad3e74b099ff3ff3f76fcc33fcdb923f0321976d44219e9df1eb0d6113eb961 Any computer that has this package installed or running should be considered...

CVE-2023-29113 A lack of access control in custom IPC mechanism

The MIB3 infotainment unit used in Skoda and Volkswagen vehicles does not incorporate any privilege separation for the proprietary inter-process communication mechanism, leaving attackers with presence in the system an ability to undermine access control restrictions implemented at the operating...

Volkswagen MIB3 Infotainment 安全漏洞

Volkswagen MIB3 Infotainment is an infotainment system on a vehicle from Volkswagen Germany. A security vulnerability exists in Volkswagen MIB3 Infotainment that stems from a lack of privilege separation in a proprietary inter-process communication mechanism, which could allow an attacker to bypa...

MAL-2025-5296 Malicious code in i-just-love-bananas-dont-mind (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 23aa7188231dd22eb43f4fbc309dbeec0c8d18b512111786fb8e61c70e65b993 The OpenSSF Package Analysis project identified 'i-just-love-bananas-dont-mind' @ 1.0.2 npm as malicious. It is considered malicious because: -...

CVE-2025-5310

Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework TCF interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution...

Malicious code in bootstrap-modules (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a45d845a42d64eb0f9732d82ec558f52eed95f2e905ffec7f0ae2849f78104e1 Any computer that has this package installed or running should be considered...

Malicious code in my-little-package-library (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-5310 Dover Fueling Solutions ProGauge MagLink LX Consoles Missing Authentication for Critical Function

Dover Fueling Solutions ProGauge MagLink LX Consoles expose an undocumented and unauthenticated target communication framework TCF interface on a specific port. Files can be created, deleted, or modified, potentially leading to remote code execution...

CVE-2025-6521 TrendMakers Sight Bulb Pro Use of a Broken or Risky Cryptographic Algorithm

During the initial setup of the device the user connects to an access point broadcast by the Sight Bulb Pro. During the negotiation, AES Encryption keys are passed in cleartext. If captured, an attacker may be able to decrypt communications between the management app and the Sight Bulb Pro which...

Malicious code in tableau-widgets-datagrid (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in defectdojo (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-5291 Malicious code in defectdojosw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 93d614c0d808786b112774fdec4eb2b8afecef6ec8de82e4945bdc644e5023c4 The OpenSSF Package Analysis project identified 'defectdojosw' @ 10.1.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-5279 Malicious code in phantom-labs-sandbox (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fd1e98be0b346737740a6114c37dc7dd21cd328f21d026e07d9eb0348e43464 Any computer that has this package installed or running should be considered...

CVE-2025-5087

Kaleris NAVIS N4 ULC Ultra Light Client communicates insecurely using zlib-compressed data over HTTP. An attacker capable of observing network traffic between Ultra Light Clients and N4 servers can extract sensitive information, including plaintext credentials...

MAL-2025-5309 Malicious code in meli-ai-chat-library (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6fe9cef75ee52e8b6473470f69a31b8e7057f0fb632c88b89af63c14484d1c13 Any computer that has this package installed or running should be considered...