MAL-2025-2040 Malicious code in grpc-examples (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b24550ca95d1b3f32e64730ef0909c4080788c96e910d97b45b9e598e4b9c222 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-GHWG-GPP4-W4X3 vulnerabilities

Vulnerabilities for packages: grpc...

GHSA-J6M3-GC37-6R6Q vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, nri-nagios, vite, kube-state-metrics, thanos, thanos-operator, nerdctl, helm-push, kubernetes-csi-external-provisioner, nri-kafka, govulncheck, sbom-scorecard, secrets-store-csi-driver-provider-gcp, k8ssandra-operator,...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: cluster-proportional-autoscaler, nri-nagios, vite, kube-state-metrics, thanos, thanos-operator, nerdctl, helm-push, kubernetes-csi-external-provisioner, nri-kafka, govulncheck, sbom-scorecard, secrets-store-csi-driver-provider-gcp, k8ssandra-operator,...

GHSA-GHWG-GPP4-W4X3 vulnerabilities

Vulnerabilities for packages: grpc...

openSUSE Security Advisory (SUSE-SU-2024:4436-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-25629 affecting package grpc for versions less than 1.42.0-9

CVE-2024-25629 affecting package grpc for versions less than 1.42.0-9. A patched version of the package is available...

OPENSUSE-SU-2025:14821-1 ruby3.4-rubygem-grpc-1.70.1-1.1 on GA media

These are all security issues fixed in the ruby3.4-rubygem-grpc-1.70.1-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE CVE-2023-1428

There exists an vulnerability causing an abort to be called in gRPC. The following headers cause gRPC's C++ implementation to abort when called via http2: te: x x != trailers :scheme: x x != http, https grpclbclientstats: x x == anything On top of sending one of those headers, a later header must...

SUSE CVE-2023-4785

Lack of error handling in the TCP server in Google's gRPC starting version 1.23 on posix-compatible platforms ex. Linux allows an attacker to cause a denial of service by initiating a significant number of connections with the server. Note that gRPC C++ Python, and Ruby are affected, but gRPC Jav...

Improper Data Encryption

Temporal api-go is vulnerable to Improper Data Encryption. The vulnerability is due to missing Data Converter transformations due to the update response information not being processed by the Data Converter when using a gRPC proxy with the api-go module, leading to unencrypted data exposure...

SUSE CVE-2023-32732

gRPC contains a vulnerability whereby a client can cause a termination of connection between a HTTP2 proxy and a gRPC server: a base64 encoding error for -bin suffixed headers will result in a disconnection by the gRPC server, but is typically allowed by HTTP2 proxies. We recommend upgrading beyo...

Unencrypted transmission in Temporal api-go library

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2025-1243

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2025-1243 Field in api-go proxy not transformed before version 1.44.1

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2025-1243 Field in api-go proxy not transformed before version 1.44.1

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

CVE-2025-1243 Field in api-go proxy not transformed before version 1.44.1

The Temporal api-go library prior to version 1.44.1 did not send update response information to Data Converter when the proxy package within the api-go module was used in a gRPC proxy prior to transmission. This resulted in information contained within the update response field not having Data...

Azure Linux 3.0 Security Update: c-ares / fluent-bit / grpc / nodejs (CVE-2023-32067)

The version of c-ares / fluent-bit / grpc / nodejs installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-32067 advisory. - c-ares is an asynchronous resolver library. c-ares is vulnerable to denial of...

Azure Linux 3.0 Security Update: containerd / cri-tools / docker-buildx / docker-compose / moby-containerd-cc (CVE-2023-47108)

The version of containerd / cri-tools / docker-buildx / docker-compose / moby-containerd-cc installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2023-47108 advisory. - OpenTelemetry-Go Contrib is a collecti...

Azure Linux 3.0 Security Update: c-ares / fluent-bit / grpc / nodejs / nodejs18 / python-gevent (CVE-2024-25629)

The version of c-ares / fluent-bit / grpc / nodejs / nodejs18 / python-gevent installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-25629 advisory. - c-ares is a C library for asynchronous DNS requests...