Malicious code in ebay-tester (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90f4e5751e5f6c07e15364668fd8d7068811404a8ba15818099e884f880adbed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dell.github.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 615b5542a30acb872c70cdfcd28099420c22dd3edecf21285afee3a811f3e967 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Oracle Java SE Multiple Vulnerabilities (January 2025 CPU)

The 8u431, 11.0.26, 17.0.14, 20.3.16, 21.0.5, 21.3.12, 23.0.2, and perf versions of Java installed on the remote host are affected by multiple vulnerabilities as referenced in the January 2025 CPU advisory. - Vulnerability in Oracle Java SE component: Install Sparkle. The supported version that i...

Malicious code in bigcommerce.github.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f610f94d4adf4f1e09e9727a8c6960c6b9c0bef8733be71242a3bfdad135f55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-325 Malicious code in wallet-history-demo-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 58e10d053f3cba02a172ebaf54943b9da709bd08e031437c58279fd60849064f The OpenSSF Package Analysis project identified 'wallet-history-demo-backend' @ 1.1.0 npm as malicious. It is considered malicious because: - Th...

Malicious code in built-with-workers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f426ea9ad545f39f1e84cd26ee384b096d08c2b82f8b3554f97fc1ce85fac83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in canva-connect-api-starter-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b678e20c1bba076695f221d78bccaa03e07883cd72690dcb6bf357845c03d3a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apple.github.io (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ee0a2d69b5b37d8393a5a3015d9baf3404208025ac3ce6e0d174b5b50053e34c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CLSA-2025-1737468474 kernel: Fix of 4 CVEs

media: edia: dvbdev: fix a use-after-free CVE-2024-27043 - btrfs: dev-replace: properly validate device names CVE-2024-26791 - KVM: nSVM: Ignore nCR34:0 when loading PDPTEs from memory CVE-2024-50115 - net/sched: stop qdisctreereducebacklog on TCHROOT CVE-2024-53057 - ipc/sem.c: bugfix for...

Oracle Java SE 安全漏洞

Oracle Java SE is an Oracle Corporation USA Java application for developing and deploying Java applications on desktops and servers, as well as embedded devices and real-time environments. A security vulnerability exists in Oracle Java SE version 8u431 that originates from a vulnerability that...

Malicious code in testpacke (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38b837aa65eec730e3f6478200b0f279baef7aab09893e795b1173e13a686837 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in showcase-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 72fdeda4a40b1170fc3888255d22ac1cb9cfe37834663d8a5812539c21e7c8e9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-native-apollo-devtools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 643d99775fbe5d1e11235967329b1d9bfdd5f173b113db79c998b0ea7f2b7b3c The OpenSSF Package Analysis project identified 'react-native-apollo-devtools' @ 1.0.0 npm as malicious. It is considered malicious because: - T...

Malicious code in snapon-imageviewer-lw (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7053e8d93acd05ac2454f25c628ab30c641d481373e8f20a08b28a0f66e1fe38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-138 Malicious code in snapon-imageviewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd4a5a0a56385d0de40f97cd52e3f9c9d0063056b50c2c1fc9a6d5c21bbe621a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-135 Malicious code in cumulus-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0f1f8e685a786d680773dae17f3fdca813dc627d1a031200036521aef32b1566 The OpenSSF Package Analysis project identified 'cumulus-dashboard' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in keystone-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d1e499fbcaddce6bdea8ab5e0bf4a301d23b6db8e65cb2647376df41c9850cb2 The OpenSSF Package Analysis project identified 'keystone-app' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

Mercedes-Benz Head Unit security research report

Introduction This report covers the research of the Mercedes-Benz Head Unit, which was made by our team. Mercedes-Benz's latest Head Unit infotainment system is called Mercedes-Benz User Experience MBUX. We performed analysis of the first generation MBUX. MBUX was previously analysed by KeenLab...

CVE-2024-12399

The CVE-2024-12399 entry concerns Schneider Electric Pro-face GP‑Pro EX and Remote HMI. The underlying issue is improper enforcement of message integrity during transmission in a communication channel, which could enable a man‑in‑the‑middle attack and lead to partial loss of confidentiality, inte...

CVE-2024-12399

CWE-924: Improper Enforcement of Message Integrity During Transmission in a Communication Channel vulnerability exists that could cause partial loss of confidentiality, loss of integrity and availability of the HMI when attacker performs man in the middle attack by intercepting the communication...