CVE-2025-14188

A security vulnerability has been detected in UGREEN DH2100+ up to 5.3.0.251125. This impacts the function handlerfilebackupcreate of the file /v1/file/backup/create of the component nassvr. The manipulation of the argument path leads to command injection. The attack is possible to be carried out...

CVE-2025-14188 UGREEN DH2100+ nas_svr create handler_file_backup_create command injection

A security vulnerability has been detected in UGREEN DH2100+ up to 5.3.0.251125. This impacts the function handlerfilebackupcreate of the file /v1/file/backup/create of the component nassvr. The manipulation of the argument path leads to command injection. The attack is possible to be carried out...

CVE-2025-14187

Summary of CVE-2025-14187 (UGREEN DH2100+) Affects the nas_svr component of UGREEN DH2100+ up to 5.3.0.251125. The vulnerability resides in the function handler_file_backup_create for the API endpoint /v1/file/backup/create where manipulation of the path argument can cause a remote buffer overflo...

JLSEC-2025-254 `tif_getimage.c` in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an...

tifgetimage.c in LibTIFF through 4.0.10, as used in GDAL through 3.0.1 and other products, has an integer overflow that potentially causes a heap-based buffer overflow via a crafted RGBA image, related to a "Negative-size-param" condition...

AZL-70931 CVE-2025-64506 affecting package libpng for versions less than 1.6.51-1

LIBPNG is a reference library for use in applications that read, create, and manipulate PNG Portable Network Graphics raster image files. From version 1.6.0 to before 1.6.51, a heap buffer over-read vulnerability exists in libpng's pngwriteimage8bit function when processing 8-bit images through t...

EUVD-2025-120009

Malicious code in swiftdragongreen-32 npm...

Malicious code in spotty-green-mouse (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 235b2d0ae78ab8ad8a86f5f1b00a821d6d7696dfa134f0f972d25217e09c3d52 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in frightened-green-whippet (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db59ba617bf579bbd2a0245f9e1b6ced1df533af2895fd80c5a6138c9976bbdc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in exuberant-green-hyena (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03875fafd4331a8040c4d090043276530f434ac439c97a1fd0764e606bbeacec This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117519

Malicious code in adverse-green-peacock npm...

EUVD-2025-117068

Malicious code in spotty-green-mouse npm...

EUVD-2025-117049

Malicious code in sunny-green-tahr npm...

Malicious code in persistent-green-tiger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6344b006626a07523e1fd1ee1a20498631a2c9826f40bf950145bf5d7685e350 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117364

Malicious code in frightened-green-whippet npm...

EUVD-2025-117509

Malicious code in basic-green-mollusk npm...

EUVD-2025-117276

Malicious code in known-green-loon npm...

Malicious code in known-green-loon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3ea21280e0ddb21957b7e41e5deb88d67447b8bbea9ad0752123e40a897d3dd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-117395

Malicious code in exuberant-green-hyena npm...

EUVD-2025-117170

Malicious code in persistent-green-tiger npm...

MAL-2025-139053 Malicious code in sunny-green-tahr (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 895ae9025a2a4cd0d8ba0dc1860b0d6e7b022857236574a2e078f9b747807afd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...