Important: Red Hat Security Advisory: cloud-init security update

An update for cloud-init is now available for Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

The vulnerability of the Applitools Eyes plugin in Jenkins automation servers, related to the storage of keys in an open manner, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Applitools Eyes plugin in Jenkins automation servers lies in the fact that keys are stored in an open manner within the config.xml configuration file. Exploiting this vulnerability allows a malicious actor, operating remotely, to gain unauthorized access to protected...

kernel security update

4.18.0-553.62.110.OL8 - Update Oracle Linux certificates Kevin Lyons - Disable signing for aarch64 Ilya Okomin - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list olkmodsigningkey.pem Orabug: 29539237 - Update x509.genkey Orabug: 24817676 - Conflict with shim-ia32 and...

The vulnerability of the Nouvola DiveCloud plugin for Jenkins’ automation server, related to the storage of keys in an unencrypted form, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Nouvola DiveCloud plugin for Jenkins-based automation servers lies in the storage of keys in an unencrypted form within the config.xml file. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information...

The vulnerability of the Kryptowire Jenkins automation server’s plugin, related to the storage of keys in an unencrypted form, allows a malicious individual to gain unauthorized access to protected information.

The vulnerability of the Kryptowire Jenkins automation server plugin relates to the storage of keys in an unencrypted form in the file org.aerogear.kryptowire.GlobalConfigurationImpl.xml. Exploiting this vulnerability could allow a malicious actor to gain unauthorized access to protected...

The vulnerability of the Nouvola DiveCloud plugin for Jenkins’ automation server, related to the storage of keys in an unencrypted form, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Nouvola DiveCloud plugin in the Jenkins automation server lies in the fact that keys are stored in an unencrypted form in the config.xml file. Exploiting this vulnerability allows a malicious actor to gain unauthorized access to protected information...

Important: cloud-init security update

The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to retrieve and install SSH keys, and to let the user run various scripts. Security Fixes: cloud-init: Cloud init permissions flaw CVE-2024-6174 For more...

RHEL 8 : cloud-init (RHSA-2025:11324)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2025:11324 advisory. The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to...

MAL-2025-5876 Malicious code in @gdstudio/web-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c2d2be9daa1f2aeccfe95af90300246eb3665a5675beeb7193abacde6d16cce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5934 Malicious code in lime-thulium (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a907ea9dce24caaae763586a97ec2bbd30c827e3f5dae239e43c2094b535bfc3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6000 Malicious code in public-tools-and-demos (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dd27fc8de7de95d23d7ed38ad3f45570fbd5a74a2f07b0e570f5240adafda3ce Any computer that has this package installed or running should be considered...

MAL-2025-5959 Malicious code in tailwind-base-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8582e0acc5f7199f1f7af95aaad0689d758cd9b4cd7110c3d2291ff6751eb5da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5909 Malicious code in ecom-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 521b798d9b0e0109ef6b2642feb49a1c930d97adfa05279b55646931ce1e6352 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5953 Malicious code in scenes-ml-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1c945347ba764d47a25e4a06c08fc0562576992fecb23b25905113a20289f0be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5939 Malicious code in nextjs-package-purify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0991599608fe8c26ceb79529ca2da64d1dff01f67c36d2cccd92ff994f41fb6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5950 Malicious code in pxsceneui-example-03 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7a2056080eb99ee23c3a6b2689ac55d696a6b788fb2030a60415a006ee3ab16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5924 Malicious code in istio-feeder (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7455087a858d4ab6e5e5e42c14c3fb5b55222d653b9b971d12b0fe56a4cc7a5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5882 Malicious code in @vapc-ui/search-box (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0da3194dfccd7f133907c4365b33fd21321477bd320e54e9115a90f0076ece9e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5879 Malicious code in @indigo-web/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97079bfe959e2a931df0187447b063d5c5fc0998cf573097f9fb9fb36105d6a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5970 Malicious code in vitejs-plugin-refresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 243a4e663f29ec03aed634b87165dccaf6f345b2e1c92479b95ef6fd28474ba5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...