Malicious code in dataflow-unified (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eeb92e0d113a35c9340e56c29e540f04d548f6e42f05f369d8e22fb5d78dea39 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in dataflow-unified

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

EUVD-2023-0479

Malicious code in bioql PyPI...

FuzzRDUCC: Fuzzing with Reconstructed Def-Use Chain Coverage

Binary-only fuzzing often struggles with achieving thorough code coverage and uncovering hidden vulnerabilities due to limited insight into a program's internal dataflows. Traditional grey-box fuzzers guide test case generation primarily using control flow edge coverage, which can overlook bugs n...

Side-Channel Extraction of Dataflow AI Accelerator Hardware Parameters

Dataflow neural network accelerators efficiently process AI tasks on FPGAs, with deployment simplified by ready-to-use frameworks and pre-trained models. However, this convenience makes them vulnerable to malicious actors seeking to reverse engineer valuable Intellectual Property IP through...

dataflow-421 (>=0.2.13, <=0.2.16), open-dataflow (0.0.2) +1 more potentially affected by CVE-2025-48887 via vllm (0.6.3)

vllm PYPI version 0.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - dataflow-421 =0.2.13, =0.2.0, =0.2.0.post2 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...

Dynamic Graph-Based Fingerprinting of In-Browser Cryptomining

The decentralized and unregulated nature of cryptocurrencies, combined with their monetary value, has made them a vehicle for various illicit activities. One such activity is cryptojacking, an attack that uses stolen computing resources to mine cryptocurrencies without consent for profit...

dataflow-421 (>=0.2.13, <=0.2.16), open-dataflow (0.0.2) +1 more potentially affected by CVE-2025-32444 via vllm (0.6.3)

vllm PYPI version 0.6.3 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - dataflow-421 =0.2.13, =0.2.0, =0.2.0.post2 Source cves: CVE-2025-32444 Source advisory: OSV:PYSEC-2025-42...

Exploit for CVE-2024-22263

CVE-2024-22263Scanner For Ethical Usage only, Any harmful or...

fake-switches (>=1.4.3, <=1.5.0), paps-settings (>=0.2.4a0, <=0.2.6a0) +4 more potentially affected by CVE-2024-41810 via twisted (16.6.0)

twisted PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - fake-switches =1.4.3, =0.2.4a0, =0.2.4, =1.1.4, =2.2.4, =2.2.6 Source cves: CVE-2024-41810 Source advisory: OSV:GHSA-CF56-G6W6-PQQ2...

fake-switches (>=1.4.3, <=1.5.0), paps-settings (>=0.2.4a0, <=0.2.6a0) +4 more potentially affected by CVE-2024-41671 via twisted (16.6.0)

twisted PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - fake-switches =1.4.3, =0.2.4a0, =0.2.4, =1.1.4, =2.2.4, =2.2.6 Source cves: CVE-2024-41671 Source advisory: OSV:GHSA-C8M8-J448-XJX7...

fake-switches (>=1.4.3, <=1.5.0), paps-settings (>=0.2.4a0, <=0.2.6a0) +4 more potentially affected by CVE-2024-41810 via twisted (16.6.0)

twisted PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - fake-switches =1.4.3, =0.2.4a0, =0.2.4, =1.1.4, =2.2.4, =2.2.6 Source cves: CVE-2024-41810 Source advisory: OSV:PYSEC-2024-75...

org.springframework.cloud:spring-cloud-dataflow-docs (>=1.5.1.release, <=1.5.2.release), org.springframework.cloud:spring-cloud-dataflow-rest-client (>=1.5.1.release, <=1.5.2.release) +23 more potentially affected by CVE-2024-37084 via org.springframework.cloud:spring-cloud-skipper (1.0.5.release)

org.springframework.cloud:spring-cloud-skipper MAVEN version 1.0.5.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-skipper and may be impacted: - org.springframework.cloud:spring-cloud-dataflow-docs...

org.springframework.cloud:spring-cloud-dataflow-classic-docs (1.6.0.release), org.springframework.cloud:spring-cloud-dataflow-docs (1.6.0.release) +24 more potentially affected by CVE-2024-37084 via org.springframework.cloud:spring-cloud-skipper (1.0.8.release)

org.springframework.cloud:spring-cloud-skipper MAVEN version 1.0.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-skipper and may be impacted: - org.springframework.cloud:spring-cloud-dataflow-classic-doc...

org.springframework.cloud:spring-cloud-dataflow-classic-docs (>=1.6.1.release, <=1.6.3.release), org.springframework.cloud:spring-cloud-dataflow-docs (>=1.6.1.release, <=1.6.3.release) +24 more potentially affected by CVE-2024-37084 via org.springframework.cloud:spring-cloud-skipper (1.0.9.release)

org.springframework.cloud:spring-cloud-skipper MAVEN version 1.0.9.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-skipper and may be impacted: - org.springframework.cloud:spring-cloud-dataflow-classic-doc...

org.springframework.cloud:spring-cloud-dataflow-classic-docs (>=1.7.2.release, <=1.7.3.release), org.springframework.cloud:spring-cloud-dataflow-docs (>=1.7.2.release, <=1.7.3.release) +24 more potentially affected by CVE-2024-37084 via org.springframework.cloud:spring-cloud-skipper (1.1.2.release)

org.springframework.cloud:spring-cloud-skipper MAVEN version 1.1.2.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-skipper and may be impacted: - org.springframework.cloud:spring-cloud-dataflow-classic-doc...

org.springframework.cloud:spring-cloud-dataflow-classic-docs (1.7.1.release), org.springframework.cloud:spring-cloud-dataflow-docs (1.7.1.release) +21 more potentially affected by CVE-2024-37084 via org.springframework.cloud:spring-cloud-skipper (1.1.1.release)

org.springframework.cloud:spring-cloud-skipper MAVEN version 1.1.1.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework.cloud:spring-cloud-skipper and may be impacted: - org.springframework.cloud:spring-cloud-dataflow-classic-doc...

fake-switches (>=1.4.3, <=1.5.0), paps-settings (>=0.2.4a0, <=0.2.6a0) +4 more potentially affected by CVE-2023-46137 via twisted (16.6.0)

twisted PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - fake-switches =1.4.3, =0.2.4a0, =0.2.4, =1.1.4, =2.2.4, =2.2.6 Source cves: CVE-2023-46137 Source advisory: OSV:GHSA-XC8X-VP79-P3WM...

fake-switches (>=1.4.3, <=1.5.0), paps-settings (>=0.2.4a0, <=0.2.6a0) +4 more potentially affected by CVE-2023-46137 via twisted (16.6.0)

twisted PYPI version 16.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - fake-switches =1.4.3, =0.2.4a0, =0.2.4, =1.1.4, =2.2.4, =2.2.6 Source cves: CVE-2023-46137 Source advisory: OSV:PYSEC-2023-224...

This Week in Spring - September 26th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you? It's September 26th, 2023, and I am in sunny Singapore for SpringOne at VMWare Explore Singapore. If you're around, don't forget to say hi! It's gonna be a fun and busy week in Singapore, and then next week I'm o...