Oracle OCI CLI 路径遍历漏洞

Oracle OCI CLI is a cloud infrastructure management command-line tool developed by Oracle Corporation in the United States. Version 3.77 of Oracle OCI CLI contains a path traversal vulnerability. This vulnerability allows unauthorized attackers to access the system through the network, enabling...

GHSA-95WW-475F-PR4F RAGAS has SSRF via Multi-Modal Faithfulness Collections Module

A security flaw has been discovered in vibrantlabsai RAGAS up to 0.4.3. The affected element is the function tryprocesslocalfile/tryprocessurl of the file src/ragas/metrics/collections/multimodalfaithfulness/util.py of the component Collections Module. Performing a manipulation of the argument...

MAL-2025-191540 Malicious code in @shr3k/tdspt-helper-ng (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d47ecdb7596afb82ccce510809a10347891034b43f4948239690d2c0bb69b470 The package @shr3k/tdspt-helper-ng was found to contain malicious code. Source: ghsa-malware...

Malicious code in no-unsupported-browser-features (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e421e834a041473c40faa9f19e564697a54e65c126010d4916e2927c757c4e78 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48235 Malicious code in redirect-ystrj5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb686c3124e1851b3eeb9b2c48defe89d5978368b71fe5e0855576605ce632da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/temporibus-id (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6ce0abddcbedfbdf7fc948b35890f2b3f206a1beb7f9c851f3adf9516aaf3843 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/assumenda-possimus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb89944fe6adc9d9300d797498b9c64e606af533104df990bf588baa47513220 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in re_rank_demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eef922d2749b6b914c7af74ab1c95d0c4ff4869dbb5619295bfee63a615ae5e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nayan-remake-tr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b59f0a229cab8bdf4c6b0666a083c7081bcf671e2b656ccb46af90b4c9cf96a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in visual_studio_1_37_1_crack_top_activation_key_latest_2019_win_mac__2rl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aa12c2f3e98ca483e099080fd151588bbeb94ca891e6a4bd70bcb301dc5d77cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gcojb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e0b34e55b1a4d57421c1e53a385614e39d6ab90a228ec840bc239fdcb6d05d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sdfere (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a8ee9251ff7135f7b45bb684699a23982f332d86a0dad6b92dab54b59dbe7fc8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

containernetworking/cni improper limitation of path name

An improper limitation of path name flaw was found in containernetworking/cni in versions before 0.8.1. When specifying the plugin to load in the 'type' field in the network configuration, it is possible to use special elements such as "../" separators to reference binaries elsewhere on the syste...

Liberapay: CSRF token manipulation in every possible form submits. NO server side Validation

Web Application is generating CSRFtoken values inside cookies which is not a best practice for web applications the revelation of cookies can reveal CSRF Tokens as well. Authenticity tokens should be kept separate from cookies and should be isolated to change operations in the account only...