python-kdcproxy: Remote DoS via unbounded TCP upstream buffering

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server e.g. through server-side request forgery, they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copie...

CVE-2025-59089

CVE-2025-59089 is a DoS in python-kdcproxy caused by unbounded TCP buffering and permissive handling of response chunks, enabling memory/CPU exhaustion when kdcproxy connects to attacker-controlled KDCs. Related issue CVE-2025-59088 concerns SSRF via DNS SRV discovery for realms, allowing probing...

CVE-2025-59089

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server e.g. through server-side request forgery, they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copie...

python-kdcproxy: Remote DoS via unbounded TCP upstream buffering

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server e.g. through server-side request forgery, they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copie...

EUVD-2025-105996

Malicious code in controlledhaddockz3n npm...

EUVD-2025-77238

Malicious code in controlledamphibian-gooddev npm...

EUVD-2025-79531

Malicious code in controlledhedgehogz3n npm...

EUVD-2025-64772

Malicious code in controlledbeetlez3n npm...

EUVD-2025-64771

Malicious code in controlledmoosez3n npm...

EUVD-2025-55187

Malicious code in controlled-chocolate-seahorse npm...

EUVD-2025-55186

Malicious code in controlled-green-crab npm...

MAL-2025-67463 Malicious code in controlled-green-crab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85f3075d4b1b291d4dc8e40aaa85da5687cff4a209b910da38f9630cb5b19bc8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SUSE CVE-2025-64436

KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could...

CVE-2025-64182

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, a memory safety bug in the legacy OpenEXR Python adapter the deprecated...

CVE-2025-60876

BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request-target path/query, allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw spac...

EUVD-2025-50490

Malicious code in controlledstoatz3n npm...

EUVD-2025-48255

Malicious code in controlledlandfowlz3n npm...

Malicious code in controlled_landfowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 429538585f09d0e939515f41598eab7729dffce3c7d55849dcf2d7b2f45dc58c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

curl: Unsafe use of strcpy in Curl_ldap_err2string (packages/OS400/os400sys.c) — stack-buffer-overflow (PoC + ASan)

I've provided the detailed description and clear steps previously, but it seems you need the content tailored directly for the submission form's fields. I will present the complete, professional, and detailed response suitable for reporting a memory corruption vulnerability to a vendor or bug...

OS Command Injection

@react-native-community/cli is vulnerable to OS Command Injection. The vulnerability is due to an exposed endpoint that accepts attacker-controlled POST data and passes it to system execution paths without proper sanitization, which allows an unauthenticated network attacker to run arbitrary...