EUVD-2025-36869

Malicious code in external-helpers npm...

Malicious code in external-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e93035f9471f41f1d28b532573b50bd3f0b5e086d74bc0fbd27e364169d71549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview external-helpers is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-49001 Malicious code in external-helpers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e93035f9471f41f1d28b532573b50bd3f0b5e086d74bc0fbd27e364169d71549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-JFG6-4GX3-3V7W Jenkins JDepend Plugin vulnerable to XML external entity attacks

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity XXE attacks. This allows attackers able to configure input files for the "Report JDepend" step to have Jenkins parse a crafted file...

XML External Entity (XXE) Injection

Overview org.jenkins-ci.plugins:jdepend is a The JDepend Plugin is a plugin to generate JDepend reports for builds. Affected versions of this package are vulnerable to XML External Entity XXE Injection due to XML parsing misconfiguration. An attacker can access sensitive information or induce...

EUVD-2025-36649

Jenkins JDepend Plugin vulnerable to XML external entity attacks...

Jenkins Nexus Task Runner Plugin vulnerable to cross-site request forgery

Jenkins Nexus Task Runner Plugin 0.9.2 and earlier does not perform a permission check in an HTTP endpoint. This allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified username and password. Additionally, this endpoint does not require POST...

CVE-2025-64134

Jenkins JDepend Plugin 1.3.1 and earlier includes an outdated version of JDepend Maven Plugin that does not configure its XML parser to prevent XML external entity XXE attacks...

CVE-2025-12461

creationtimestamp| type| source ---|---|--- 2025-10-29 14:01:23+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m4dmcorlxx2u...

CVE-2025-64134

CVE-2025-64134 affects the Jenkins JDepend Plugin (versions 1.3.1 and earlier) which embeds an outdated JDepend Maven Plugin that does not configure its XML parser to prevent XML External Entity (XXE) attacks. Reports and advisories describe XXE injection via crafted files in the JDepend Report s...

Keras 安全漏洞

Keras is a multi-backend deep learning framework open-sourced by Keras. A security vulnerability exists in Keras that stems from the StringLookup layer not properly restricting external path loading functionality when processing specially crafted .keras archives, which could lead to arbitrary loc...

PT-2025-44283

Name of the Vulnerable Software and Affected Versions Jenkins JDepend Plugin versions 1.3.1 and earlier Description The Jenkins JDepend Plugin uses an outdated version of the JDepend Maven Plugin that lacks proper configuration of its XML parser. This configuration deficiency can allow for XML...

Dell Storage Manager XML External Entity References Improperly Restricted Vulnerability

Dell Storage Manager is a centralized storage management tool from Dell that is used to manage storage devices such as SC Series, PS Series and FluidFS, providing unified monitoring, configuration and replication capabilities. An XML External Entity Reference Improper Restriction vulnerability...

Jenkins plugin JDepend 安全漏洞

Jenkins and Jenkins plugin are both Jenkins open source products.Jenkins is an application software. An open source automation server Jenkins provides hundreds of plugins to support building, deploying and automating any project.Jenkins plugin is an application software plugin. A security...

Files or Directories Accessible to External Parties

Overview Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the secure persistent volume feature. An attacker can access confidential data stored in persistent volumes by providing a crafted LUKS2 volume with a null key-encryption algorithm...

CVE-2025-34304

creationtimestamp| type| source ---|---|--- 2025-10-28 15:43:37+00:00| seen| https://infosec.exchange/users/cR0w/statuses/115452557190111700...

MAL-2025-48931 Malicious code in internallib_v799 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eee173949777ba0b061bf769290f356eb15c53e47c71278188116dbf5277c404 The package internallibv799 was found to contain malicious code. Source: ghsa-malware 90a16371dd0bdd2b43694453483bd59007c45f09296a782bb436d256daa8264...

MAL-2025-48925 Malicious code in ews-paze-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 919f20823a98370aeff343ebdedbd1f86353649a1f852ec6c5ef7314925970d4 The package ews-paze-toolkit was found to contain malicious code. Source: ghsa-malware 60989a72103601dc11b185549de7abb4bdb1442776d790dab1945d25b5ab27...

MAL-2025-48934 Malicious code in shopify-logistics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c496eebb9741a5d54e47561695a16482339e4d8b2094e4269c722c2cd17b04b The package shopify-logistics was found to contain malicious code. Source: ghsa-malware...