MAL-2025-70684 Malicious code in small-magenta-whale (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56f5dc848ef34ab27ef85e731483b99788cab7f05272a33ac77ee0c33c1a9db4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-68925 Malicious code in intact-crimson-rodent (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 593f864bd2be15f0c9fcb8d837cca08ad4ac1b253c8da109b8714dcb1f4e640d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in past-sapphire-wombat (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db19159f743e92941f4ade673f87684ea41cc0b81272779e6a256f1309f30bd5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-60601 Malicious code in hilarious_pig_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fac26f2d009641adf1308f0dc1eaaffb648828c1ca4dc2766ca0f398fa2b491d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dian-brongkos89-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d50e0ff683eda9ac4dd15d50a6771690fae36c248df0c8ccd8fb25f919b065f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-58768 Malicious code in spontaneous_unicorn_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 30657310a4b14ea562abd1c4a41fff435d963b72bc31a5a5edd515e738d1cb42 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joko-semur14-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d74ef200d25a792259292e3390c1f6ea364971573a234182fa1329badc0131bb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-botok59-pore (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd2ab92ae92f564a6e8c8beb24d8dc0cbfa803799e2a2bd359ac8c22bc992c47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in joni-mendoan12-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 189b3ffe97f66ee44c8ae891025598933dbd17015a30ec36ae252acbe02a871d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-52217 Malicious code in maman-kupang98-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c834d1b5aca0774a30e6a2c2e707211758a0a9126aa34288cb7c53614619689 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in candra-lengko4-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b640e95942b0a028eb5a6b76b28845de730bf6794f450493d4bd760398a61f88 The package candra-lengko4-sluey was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that flood...

USN-6310-1: json-c vulnerability

It was discovered that json-c incorrectly handled certain JSON files. An attacker could possibly use this issue to cause a crash or execute arbitrary code...

GLSA-202305-37 : Apache Tomcat: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202305-37 Apache Tomcat: Multiple Vulnerabilities - If Apache Tomcat 8.5.0 to 8.5.82, 9.0.0-M1 to 9.0.67, 10.0.0-M1 to 10.0.26 or 10.1.0-M1 to 10.1.0 was configured to ignore invalid HTTP headers via setting rejectIllegalHeader to...

Security Bulletin: Vulnerability in Apache Tomcat affects IBM Process Mining . CVE-2022-45143

Summary There is a vulnerability in Apache Tomcat could allow a remote attacker to bypass security restrictions. The code is used by IBM Process Mining. This bulletin identifies the security fixes to apply to address the vulnerability. Vulnerability Details CVEID:CVE-2022-45143 DESCRIPTION: Apach...

Important: tomcat9

Issue Overview: The simplified implementation of blocking reads and writes introduced in Tomcat 10 and back-ported to Tomcat 9.0.47 onwards exposed a long standing but extremely hard to trigger concurrency bug in Apache Tomcat 10.1.0 to 10.1.0-M12, 10.0.0-M1 to 10.0.18, 9.0.0-M1 to 9.0.60 and 8.5...

CVE-2023-25560

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

Apache Tomcat improperly escapes input from JsonErrorReportValve

The JsonErrorReportValve in Apache Tomcat 8.5.83, 9.0.40 to 9.0.68 and 10.1.0-M1 to 10.1.1 does not escape the type, message or description values. In some circumstances these are constructed from user provided data and it was therefore possible for users to supply values that invalidated or...

PT-2022-7336

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 8.5.83, 9.0.40 through 9.0.68, 10.1.0-M1 through 10.1.1 Description The issue is related to the JsonErrorReportValve in Apache Tomcat, which does not properly escape the type, message, or description values. These values...

CVE-2017-20110

A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the component Administration. The manipulation as part of JSON leads to information disclosure Credentials. The attack may be launched remotely...

Information disclosure

A vulnerability, which was classified as problematic, has been found in Teleopti WFM up to 7.1.0. Affected by this issue is some unknown functionality of the component Administration. The manipulation as part of JSON leads to information disclosure Credentials. The attack may be launched remotely...