GHSA-X44P-GVRJ-PJ2R Amazon S3 Encryption Client for Java has a Key Commitment Issue

Summary S3 Encryption Client for Java is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamander...

Amazon S3 Encryption Client for .NET has a Key Commitment Issue

S3 Encryption Client for .NET S3EC is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamanders"...

AWS SDK for Ruby's S3 Encryption Client has a Key Commitment Issue

Summary S3 Encryption Client for Ruby is an open-source client-side encryption library used to facilitate writing and reading encrypted records to S3. When the encrypted data key EDK is stored in an "Instruction File" instead of S3's metadata record, the EDK is exposed to an "Invisible Salamander...

Time Will Tell: Large-Scale De-Anonymization of Hidden I2P Services Via Live Behavior Alignment (Extended Version)

I2P Invisible Internet Project is a popular anonymous communication network. While existing de-anonymization methods for I2P focus on identifying potential traffic patterns of target hidden services among extensive network traffic, they often fail to scale effectively across the large and diverse...

EUVD-2025-91045

Malicious code in invisiblehippopotamusz3n npm...

EUVD-2025-81491

Malicious code in invisiblepony0xrequest npm...

Malicious code in invisible_pony_0xrequest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 710288f46f89219312a2cd0385f4f090d8b11ebf0329e910ed5789b997c9f500 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-81494

Malicious code in invisiblearmadillodumbs npm...

EUVD-2025-63442

Malicious code in invisiblecrawdadz3n npm...

EUVD-2025-63440

Malicious code in invisibledragonflyz3n npm...

EUVD-2025-63439

Malicious code in invisibleguppyrequirement npm...

EUVD-2025-63443

Malicious code in invisiblechickadeez3n npm...

EUVD-2025-53671

Malicious code in invisible-amethyst-newt npm...

EUVD-2025-59116

Malicious code in invisibleelkz3n npm...

EUVD-2025-59117

Malicious code in invisibleboobyz3n npm...

EUVD-2025-49954

Malicious code in invisiblegibbonz3n npm...

PT-2025-45105

Name of the Vulnerable Software and Affected Versions MDaemon Mail Server version 23.5.2 Description MDaemon Mail Server version 23.5.2 validates Sender Policy Framework SPF, DomainKeys Identified Mail DKIM, and Domain-based Message Authentication, Reporting & Conformance DMARC using the email...

CVE-2025-61084

MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing eve...

CVE-2025-61084

MDaemon Mail Server 23.5.2 is described as validating SPF, DKIM, and DMARC using the From header content enclosed in angle brackets () during SMTP DATA. An attacker can craft a From header using multiple invisible Unicode thin spaces to display a spoofed sender while still passing validation, ena...

CVE-2025-61084

MDaemon Mail Server 23.5.2 validates SPF, DKIM, and DMARC using the email enclosed in angle brackets in the From: header of SMTP DATA. An attacker can craft a From: header with multiple invisible Unicode thin spaces to display a spoofed sender while passing validation, allowing email spoofing eve...