219 matches found
Password Reuse in Disguise: An Often-Missed Risky Workaround
When security teams discuss credential-related risk, the focus typically falls on threats such as phishing, malware, or ransomware. These attack methods continue to evolve and rightly command attention. However, one of the most persistent and underestimated risks to organizational security remain...
CVE-2025-68703
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sumpassphrase. Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2...
CVE-2025-68703 Jervis has a Salt for PBKDF2 derived from password
Jervis is a library for Job DSL plugin scripts and shared Jenkins pipeline libraries. Prior to 2.2, the salt is derived from sha256Sumpassphrase. Two encryption operations with the same password will have the same derived key. This vulnerability is fixed in 2.2...
CVE-2025-68703
CVE-2025-68703 affects the Jervis library used with Jenkins Job DSL and shared pipelines. Prior to version 2.2, the salt for PBKDF2 is derived from the SHA-256 hash of the passphrase, causing two encryption operations using the same password to yield the same derived key. This design enables pre-...
Jervis has Deterministic AES IV Derivation from Passphrase
Vulnerability https://github.com/samrocketman/jervis/blob/157d2b63ffa5c4bb1d8ee2254950fd2231de2b05/src/main/groovy/net/gleske/jervis/tools/SecurityIO.groovyL866-L874...
PT-2026-2496
Name of the Vulnerable Software and Affected Versions Jervis versions prior to 2.2 Description Jervis, a library for Job DSL plugin scripts and shared Jenkins pipeline libraries, is affected by an issue where the salt used in encryption is derived from the SHA256 sum of the passphrase. This means...
SecureDyn-FL: A Robust Privacy-Preserving Federated Learning Framework for Intrusion Detection in IoT Networks
The rapid proliferation of Internet of Things IoT devices across domains such as smart homes, industrial control systems, and healthcare networks has significantly expanded the attack surface for cyber threats, including botnet-driven distributed denial-of-service DDoS, malware injection, and dat...
CVE-1999-0556
Two or more Unix accounts have the same UID...
Malicious code in identical-ivory-peafowl (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a2a179d493bfa3f0bfdb67e247b1109929d4e6daa45e2e14e2c64414713bd22 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-117314
Malicious code in identical-ivory-peafowl npm...
EUVD-2025-117313
Malicious code in identical-ivory-wolverine npm...
Malicious code in identical_mule_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 287bf705839d362cc65f5f5b53a024d39eb0f305d4b9253342d692953aa9c369 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in identical_alpaca_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 145f95f5a55a303acf898b70ba3061882d632019e27c143439902615b2979551 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in identical_canidae_tomato-90 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b12c4b1136140bc38c94f806b31a05c0835dde6b204b22ca4bbc65b72ce06669 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-77595
Malicious code in identicalmouseaquamarine-62 npm...
EUVD-2025-79070
Malicious code in identicaldolphinz3n npm...
EUVD-2025-81635
Malicious code in identicalwhippet0xrequest npm...
EUVD-2025-69884
Malicious code in identicalwallabyz3n npm...
Malicious code in identical_cobra_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8654b05c7e4a6e621ae7a10f587823868b8b6ae4bd904f36bc37467480587e60 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...