MAL-2025-1461 Malicious code in archon5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49f96513d49b650de14afd8f58eb7a9af6e3f48e3af96d2fff186b24b49aa28d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in archon2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2efbecb91840f3bd10abd707ee59f45fc25c310b59477444324c0d40c7e128bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the NFC component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the NFC component in the Linux operating system’s kernel is related to insufficient validation of input data in the nciaddnewprotocol function. Exploiting this vulnerability could allow a perpetrator to cause service failures...

Malicious code in linter-coffee-variables (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 292d0ff0a104c6e415fc2ea734ec189f699d6aecb4383502759e2053adddfb45 The OpenSSF Package Analysis project identified 'linter-coffee-variables' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-1388 Malicious code in zmcrypty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ee24745300aa11ed0e92813032e7269a17e9c66f73b03ac3e38e6bd613268e1c The OpenSSF Package Analysis project identified 'zmcrypty' @ 66.6.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in tesdf45454t (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bab99ac2b3599508ec9355c7499892e486ae8d8d433fa04e1da03449d7e0993 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1391 Malicious code in voiceedgelite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis fd93b14a943a875efb1d2602d31cc497e92f135adac765f65f2a0ffd72d6ad42 The OpenSSF Package Analysis project identified 'voiceedgelite' @ 1.1.5 npm as malicious. It is considered malicious because: - The package...

Malicious code in uyurettrtrtst (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f69974d01d68b2e9cd5e64fdd40891f5a03977026f82ced386274cf20c966e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1383 Malicious code in rust-analyzer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f080c05d4a8b07c42704d1ef9fb6f6d30d4128e3f5976f6645a3b8858cb10580 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1059

CWE-770: Allocation of Resources Without Limits or Throttling vulnerability exists that could cause communications to stop when malicious packets are sent to the webserver of the device...

[SECURITY] Fedora 40 Update: nginx-mod-modsecurity-1.0.3-16.fc40

The ModSecurity-nginx connector is the connection point between nginx and libmodsecurity ModSecurity v3. Said another way, this project provides a communication channel between nginx and libmodsecurity. This connector is required to use LibModSecurity with nginx. The ModSecurity-nginx connector...

CVE-2025-0556

In Progress® Telerik® Report Server, versions prior to 2025 Q1 11.0.25.211 when using the older .NET Framework implementation, communication of non-sensitive information between the service agent process and app host process occurs over an unencrypted tunnel, which can be subjected to local netwo...

Overcoming Security Challenges in Real-Time APIs

Speed is everything in the modern business world. Our attention spans are shorter than ever, consumers demand short and seamless interactions, and the slightest delay in service delivery can see organizations fall far behind their competitors. This is why real-time APIs are so important; they...

SUSE CVE-2024-52338

Deserialization of untrusted data in IPC and Parquet readers in the Apache Arrow R package versions 4.0.0 through 16.1.0 allows arbitrary code execution. An application is vulnerable if it reads Arrow IPC, Feather or Parquet data from untrusted sources for example, user-supplied input files. This...

Progress Telerik Report Server < 11.0.25.211 Cleartext Transmission

The version of Progress Telerik Report Server installed on the remote host is affected by an cleartext transmission vulnerability. In Progress® Telerik® Report Server, versions prior to 2025 Q1 11.0.25.211 when using the older .NET Framework implementation, communication of non-sensitive...

CVE-2025-24888

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to version 0.14.1, a malicious SecureDrop Server could obtain code execution on the SecureDrop Client virtual machine sd-app. SecureDrop Server...

CVE-2025-24889 Path traversal in sd-log Qubes virtual machine

The SecureDrop Client is a desktop application for journalists to communicate with sources and work with submissions on the SecureDrop Workstation. Prior to versions 0.14.1 and 1.0.1, an attacker who has already gained code execution in a virtual machine on the SecureDrop Workstation could gain...

CVE-2024-54015

A vulnerability has been identified in SIPROTEC 5 6MD84 CP300 All versions = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 = V8.80 V10.0, SIPROTEC 5 7ST85 CP300 V9.6x All versions V9.68, SIPROTEC 5 7ST86 CP300 All versions...

CVE-2024-39271

Improper restriction of communication channel to intended endpoints in some IntelR PROSet/Wireless WiFi and Killerâ„¢ WiFi software before version 23.80 may allow an unauthenticated user to potentially enable information disclosure via adjacent access...

CVE-2024-39271

CVE-2024-39271 affects Intel PROSet/Wireless WiFi and Killer WiFi software prior to version 23.80. The root cause is improper restriction of the communication channel to intended endpoints, which could allow an unauthenticated adjacent user to disclose information. Multiple sources (Intel advisor...