Malicious code in monophonic (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 638fb2d3ef5574e603743a5f8545f9bd01c8d2f544f628cbe041b12a94497155 The package monophonic was found to contain malicious code. Source: ghsa-malware 7a86916baf347f5489f90e15cce360f5a7bea0ba71f59130e66754f1c4acec9a Any...

CVE-2025-12602

/etc/avahi/services/z9.service can be Arbitrarily Written.This issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

ASD Warns of Ongoing BADCANDY Attacks Exploiting Cisco IOS XE Vulnerability

The Australian Signals Directorate ASD has issued a bulletin about ongoing cyber attacks targeting unpatched Cisco IOS XE devices in the country with a previously undocumented implant known as BADCANDY. The activity, per the intelligence agency, involves the exploitation of CVE-2023-20198 CVSS...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: lan743x: The EEPROM and OTP sizes for PCI1xxxx devices have been modified. The maximum OTP and EEPROM sizes for PCI1xxxx devices are 8 Kb and 64 Kb respectively. The maximum size definitions have been adjusted, and the corre...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: usb: asixdevices: The PHY address mask in MDIO bus initialization was corrected. Syzbot reported a shift-out-of-bounds exception during MDIO bus initialization. The PHY address should be masked to 5 bits 0-31. Without this...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: dm: Always split write BIOs to zoned device limits Any zoned DM target that requires zone append emulation will use the block layer zone write plugging mechanism. In such cases, DM target drivers must not split BIOs using...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Restored the context entry setup order for aliased devices. The commit 2031c469f816 “iommu/vt-d: Added support for static identity domains” changed the context entry setup during domain attachment from a set-and-check...

Astra Linux – Vulnerability in udisks2

A flaw was discovered in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is accomplished through the loop device handler, which processes requests sent through the D-BUS interface. As part of this handler’s functionality, it receives a lis...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: iio: common: stsensors: Fixed the use of uninitialized device structures. In various probe functions, indiodev-dev is used before it is initialized. This caused a kernel panic in stsensorspowerenable when the call to...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: Nilfs2: Rejects invalid file types when reading inodes. To prevent inodes with invalid file types from causing malfunctions or assertion failures, a missing sanity check should be added when reading an inode from a block device. ...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: usb: asixdevices: add phymask for ax88772 mdio bus Without setting the phymask for the ax88772 mdio bus, the current driver may create at most 32 mdio PHY devices with PHY addresses ranging from 0x00 to 0x1f. The DLink...

CVE-2025-12517

Credits Page not Matching Versions in Use in the FirmwareThis issue affects BLU-IC2: through 1.19.5; BLU-IC4: through 1.19.5...

USN-7833-4: Linux kernel (GCP) vulnerabilities

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to...

USN-7833-4 linux-gcp-6.14 vulnerabilities

Oleksii Oleksenko, Cedric Fournet, Jana Hofmann, Boris Köpf, Stavros Volos, and Flavien Solt discovered that some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information. A local attacker could possibly use this to...

CVE-2025-58149

When passing through PCI devices, the detach logic in libxl won't remove access permissions to any 64bit memory BARs the device might have. As a result a domain can still have access any 64bit memory BAR when such device is no longer assigned to the domain. For PV domains the permission leak allo...

CVE-2025-58152

FutureNet MA and IP-K series provided by Century Systems Co., Ltd. put the firmware version and the garbage collection information on the internal web page. With some crafted HTTP request, they can be accessed without authentication...

EUVD-2025-37234

A vulnerability was identified in certain UniFi Talk devices where internal debugging functionality remained unintentionally enabled. This issue could allow an attacker with access to the UniFi Talk management network to invoke internal debug operations through the device API. Affected Products:...

Malicious code in bael-god-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 54ba754b9dbef244bd2b53886b1f45560769963fb3cec0acdca0b97146c4748a The package bael-god-admin was found to contain malicious code. Source: ghsa-malware a5f348ec1bb90ae0b0173cad94148bc4e8942fd31411b6ae86b2a81f71aa4587...

Malicious code in abeya-tg-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37d3c8662c688eccce2f52334ff40029218abfe48b990a194be49c6e01f5fb57 The package abeya-tg-api was found to contain malicious code. Source: ghsa-malware 01b4d597b84a4aa049cd970002730cf004fb59ff7fb53a7c70196644a0c047e4 A...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-7850-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-7850-1 advisory. Jean-Claude Graf, Sandro Regge, Ali Hajiabadi, and Kaveh Razavi discovered that the Linux kernel contained insufficient branch predictor isolation betwee...