Malicious code in hushed_crayfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 926f3834798686240b93486b3bc7629e9dbb165f356ec7dc07b4427e3b28d846 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in wooden_crayfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 20edd740961dd674432f945b4c58912dcf24f51864dfe59186e32957f19c05b5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-49017

Malicious code in woodencrayfishz3n npm...

EUVD-2025-49984

Malicious code in innocentcrayfishz3n npm...

EUVD-2025-50533

Malicious code in completecrayfishz3n npm...

EUVD-2025-4966

Malicious code in bioql PyPI...

EUVD-2025-0100

Malicious code in bioql PyPI...

EUVD-2025-4100

Malicious code in bioql PyPI...

CVE-2025-25286

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286 Crayfish allows Remote Code Execution via Homarus Authorization header

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286 Crayfish allows Remote Code Execution via Homarus Authorization header

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286 Crayfish allows Remote Code Execution via Homarus Authorization header

Crayfish is a collection of Islandora 8 microservices, one of which, Homarus, provides FFmpeg as a microservice. Prior to Crayfish version 4.1.0, remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The issue has been patched in...

CVE-2025-25286

CVE-2025-25286 affects Crayfish’s Homarus FFmpeg microservice. Prior to Crayfish 4.1.0, remote code execution could occur in web-accessible installations in certain configurations. The issue has been patched in islandora/crayfish:4.1.0. Workarounds include preventing Internet access to Homarus or...

Crayfish 安全漏洞

Crayfish is a collection of Islandora microservices open-sourced by Islandora. A security vulnerability exists in Crayfish that stems from remote code execution that can occur in Homarus installations that are accessible via the Web under certain configurations...

GHSA-C2P2-HGJG-9R3F Crayfish Allows Remote Code Execution via hypercube X-Islandora-Args Header

Impact What kind of vulnerability is it? Who is impacted? Remote code execution is possible in web-accessible installations of hypercube. Patches Has the problem been patched? What versions should users upgrade to? Not yet, though no patch is neccessary if your installation of the microservices i...

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Overview Affected versions of this package are vulnerable to Improper Neutralization of Special Elements in Output Used by a Downstream Component 'Injection' via the X-Islandora-Args header. An attacker can execute arbitrary code on the server by sending a crafted request containing malicious inp...

Failure to Sanitize Paired Delimiters

Overview Affected versions of this package are vulnerable to Failure to Sanitize Paired Delimiters via the Authorization header, by sending a crafted request to the /convert endpoint. Note: This is only exploitable if the Homarus microservice is directly accessible from the Internet. Remediation...

PT-2025-7069

Name of the Vulnerable Software and Affected Versions: Crayfish versions prior to 4.1.0 Description: Remote code execution may be possible in web-accessible installations of Homarus in certain configurations. The exploit requires making a request against the Homarus's "/convert" endpoint. To redu...

crayfish-geschichte.de Cross Site Scripting vulnerability OBB-3706478

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...