Malicious code in env-check-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04728a28db58b9a9e546a8840e5cca54ab1f7dcf20fbb0817639e0c738a3bc32 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2256 Malicious code in env-check-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04728a28db58b9a9e546a8840e5cca54ab1f7dcf20fbb0817639e0c738a3bc32 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the httpGetEnv() function in the microprogramming software of TP-Link’s wireless signal booster device TL-WA850RE allows a hacker to induce a service failure.

The vulnerability of the httpGetEnv function in the microprogramming software of TP-Link’s wireless signal booster device TL-WA850RE is related to the operation that goes beyond the buffer in memory when processing the end-point data/syslog.filter.json file with the type parameter. Exploiting thi...

The vulnerability of the httpGetEnv() function (userRpm/WanDynamicIpV6CfgRpm.htm) in TP-Link TL-WR841ND router software allows a attacker to cause a service failure.

The vulnerability of the httpGetEnv function userRpm/WanDynamicIpV6CfgRpm.htm in the TP-Link TL-WR841ND router software is related to buffer overflows caused by improper cleaning or resource release when processing the gw parameter. Exploiting this vulnerability allows a remote attacker to cause...

PT-2025-25834

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved. The issue is related to the bpf verifier, where the copy verifier state function should copy the loop entry field. If not copied,...

UBUNTU-CVE-2025-24959

zx is a tool for writing better scripts. An attacker with control over environment variable values can inject unintended environment variables into process.env. This can lead to arbitrary command execution or unexpected behavior in applications that rely on environment variables for...

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

CVE-2024-55555

Technical details (affected versions, vulnerable components, impact scope, and fixes) are not publicly provided in the supplied documents. Monitor for updates.

CVE-2024-55555

Invoice Ninja before 5.10.43 allows remote code execution from a pre-authenticated route when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values. The route/hash route defined in the invoiceninja/routes/client.p...

Malicious code in spinal-env-viewer-plugin-documentation-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3d2a0a560ea9b62097643b0b538b82a0eba36ef923886755262eeecca376650 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2024-53257

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

GO-2024-3306 Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess

Vitess allows HTML injection in /debug/querylogz and /debug/env in vitess.io/vitess...

GHSA-7MWH-Q3XM-QH6P Vitess allows HTML injection in /debug/querylogz & /debug/env

Summary The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. Details These pages are rendered using text/template instead of rendering with a proper HTML...

Vitess allows HTML injection in /debug/querylogz & /debug/env

Summary The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. Details These pages are rendered using text/template instead of rendering with a proper HTML...

AZL-53970 CVE-2024-53257 affecting package vitess for versions less than 19.0.4-7

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

CVE-2024-53257 Vitess allows HTML injection in /debug/querylogz & /debug/env

Vitess is a database clustering system for horizontal scaling of MySQL. The /debug/querylogz and /debug/env pages for vtgate and vttablet do not properly escape user input. The result is that queries executed by Vitess can write HTML into the monitoring page at will. These pages are rendered usin...

Vitess 安全漏洞

Vitess is a database clustering system for horizontally scaling MySQL from the Vitess open source. A security vulnerability exists in Vitess that stems from the /debug/querylogz and /debug/env pages of vtgate and vttablet not properly escaping user input...

Malicious code in spinal-env-viewer-graph-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15cfd840bc992aaee2f17022820c0f005a0e47a499c6939bc0ee0c5635cd47fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update for postgresql14

This update for postgresql14 fixes the following issues: CVE-2024-10976: Ensure cached plans are marked as dependent on the calling role when RLS applies to a non-top-level table reference bsc1233323. CVE-2024-10977: Make libpq discard error messages received during SSL or GSS protocol negotiatio...

nope-env (=1.0.0) potentially affected by CVE-2020-26309 via nope-validator (=0.11.3)

nope-validator NPM version =0.11.3 is affected by a known vulnerability. The following packages have a transitive dependency on nope-validator and may be impacted: - nope-env =1.0.0 Source cves: CVE-2020-26309 Source advisory: OSV:GHSA-3PHV-83CJ-P8P7...