Authorization Bypass Through User-Controlled Key

Overview Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key in the account linking logic. An attacker can anticipate and use the email address of a user to register a public frontend user account before the user's first OIDC login, leading to...

TYPO3-EXT-SA-2025-001: Account Takeover in extension "OpenID Connect Authentication" (oidc)

More info at https://typo3.org/security/advisory/typo3-ext-sa-2025-001...

MAL-2025-550 Malicious code in meli-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 51bcf8ede43a6fd8fa810529ae2d62e97197165ba94b7d41c8b58e3607d39551 The OpenSSF Package Analysis project identified 'meli-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in meli-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 51bcf8ede43a6fd8fa810529ae2d62e97197165ba94b7d41c8b58e3607d39551 The OpenSSF Package Analysis project identified 'meli-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-528 Malicious code in lyft-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 315320431749982def4c72ea78c96ab88faead336d157234851073d549dd50b5 The OpenSSF Package Analysis project identified 'lyft-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in lyft-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 315320431749982def4c72ea78c96ab88faead336d157234851073d549dd50b5 The OpenSSF Package Analysis project identified 'lyft-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in iberia-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 955b26e00ecd6ed2d59e40af04de984e2e14a38fef862c06b173b38387bea3af The OpenSSF Package Analysis project identified 'iberia-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-490 Malicious code in iberia-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 955b26e00ecd6ed2d59e40af04de984e2e14a38fef862c06b173b38387bea3af The OpenSSF Package Analysis project identified 'iberia-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-479 Malicious code in google-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b73909cac81405458f9e1a50331aa80aed75bf630379f2eebdb3d06801457d56 The OpenSSF Package Analysis project identified 'google-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in google-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b73909cac81405458f9e1a50331aa80aed75bf630379f2eebdb3d06801457d56 The OpenSSF Package Analysis project identified 'google-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in dropbox-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis afdb751e57da5540b343e220fab07e5aa40ad53e4bf33fbadb1e8f53d8469261 The OpenSSF Package Analysis project identified 'dropbox-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-435 Malicious code in dropbox-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis afdb751e57da5540b343e220fab07e5aa40ad53e4bf33fbadb1e8f53d8469261 The OpenSSF Package Analysis project identified 'dropbox-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in coinbase-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 710b36fc278e57d50e7ce86d489ae5e2da89f2ac58f80653232e0b2f7283e451 The OpenSSF Package Analysis project identified 'coinbase-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-419 Malicious code in coinbase-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 710b36fc278e57d50e7ce86d489ae5e2da89f2ac58f80653232e0b2f7283e451 The OpenSSF Package Analysis project identified 'coinbase-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in amazon-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 67f6356994dd39435390e83ed9cb9495679ba7bd9430eb6deb610ff5a59ed159 The OpenSSF Package Analysis project identified 'amazon-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-375 Malicious code in amazon-connect (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 67f6356994dd39435390e83ed9cb9495679ba7bd9430eb6deb610ff5a59ed159 The OpenSSF Package Analysis project identified 'amazon-connect' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS are vulnerable to multiple CVEs in IBM Java SDK

Summary There are multiple vulnerabilities in IBM Java SDK, Java Technology Edition used by IBM App Connect Enterprise Runtime and IBM Integration Bus for z/OS Runtime. Vulnerability Details CVEID:CVE-2024-21235 DESCRIPTION: Vulnerability in Java SE component: Hotspot. Difficult to exploit...

Jenkins plugins Multiple Vulnerabilities (2025-01-22)

According to their self-reported version numbers, the version of Jenkins plugins running on the remote web server are affected by multiple vulnerabilities: - Jenkins OpenId Connect Authentication Plugin 4.452.v2849bd3945fa and earlier, except 4.438.440.v3f5f201de5dc, treats usernames as...

Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin

The Jenkins OpenId Connect Authentication Plugin 4.452.v2849bd3945fa and earlier treats usernames as case-insensitive. On a Jenkins instance configured with a case-sensitive OpenID Connect provider, this allows attackers to log in as any user by providing a username that differs only in letter...

GHSA-Q9CM-88JX-3VFW Improper handling of case sensitivity in Jenkins OpenId Connect Authentication Plugin

The Jenkins OpenId Connect Authentication Plugin 4.452.v2849bd3945fa and earlier treats usernames as case-insensitive. On a Jenkins instance configured with a case-sensitive OpenID Connect provider, this allows attackers to log in as any user by providing a username that differs only in letter...