Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the cert.NewLeaf function. An attacker can obtain sensitive private key material by intercepting certificates transmitted in plaintext during a TLS handshake, allowing impersonation of eith...

Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the cert.NewLeaf function. An attacker can obtain sensitive private key material by intercepting certificates transmitted in plaintext during a TLS handshake, allowing impersonation of eith...

MAL-2025-5453 Malicious code in price_wrapper (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f5ebf05195379c1b9f9c6c4d2e95b165168168a4ebba5c036cc803789ac46d2 Any computer that has this package installed or running should be considered...

SUSE-RU-2025:20460-1 Recommended update for gpg2

This update for gpg2 fixes the following issues: This reverts the CVE-2025-30258 fix, as it changed behaviour when using expired keys...

MAL-2025-5500 Malicious code in guild-rotator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a65fe418eb6f3e397826f4b880e1a87b1966ddc4813ed73c05697b831d23e31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in themeone-animate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e147615a6d4e51665cb5f31f094f28cbb4c79a9c3ea92899c8a0a37ea40bb4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5519 Malicious code in sdp-transform-grammar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 26ec9a8ad7301b26c32473ba504289ab4b40d221d1de8d91e2d7119ab847b102 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5491 Malicious code in cloak-security (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d81546f41c53f13a46b7c372cd2ac89b76c664542fb9b1652357cde5323830f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Canonical Juju utils 安全漏洞

Canonical Juju utils is an open source package from Canonical Juju. A security vulnerability exists in Canonical Juju utils, which stems from the fact that private information may be included in the certificate generation process, which could lead to private key disclosure...

[SECURITY] [DLA 4236-1] mbedtls security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4236-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura June 30, 2025 https://wiki.debian.org/LTS -...

MAL-2025-5454 Malicious code in protos-gen-node (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b60e42ad145edc7eb0f1f70effb36918da50d55a15cc4a3d075d63c97335bfa Any computer that has this package installed or running should be considered...

MAL-2025-5399 Malicious code in ee_else_ce (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1573503c97a28616ebbe0ac70f2124f6761b31b0ead756cc1b9e6a9b4a116127 Any computer that has this package installed or running should be considered...

Leveraging Credentials As Unique Identifiers: A Pragmatic Approach To NHI Inventories 

Identity-based attacks are on the rise. Attacks in which malicious actors assume the identity of an entity to easily gain access to resources and sensitive data have been increasing in number and frequency over the last few years. Some recent reports estimate that 83% of attacks involve compromis...

MAL-2025-5525 Malicious code in very-zeld (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec45b5cdcc59c7f8b7328486d203c3f448f7e43d5fdbcdd1ebecf25b6fb072f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5502 Malicious code in jsonlogs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware de467478eb6a14c26e0545351ab7bf4545a3a66b145512c0b8babc5b8b3a51eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE-SU-2025:02171-1 Security update for the Linux Kernel (Live Patch 19 for SLE 15 SP5)

This update for the Linux Kernel 5.14.21-1505005580 fixes several issues. The following security issues were fixed: - CVE-2024-56601: net: inet: do not leave a dangling sk pointer in inetcreate bsc1235231. - CVE-2024-50279: dm cache: fix out-of-bounds access to the dirty bitset when resizing...

Oracle Linux 10 : krb5 (ELSA-2025-9418)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-9418 advisory. - Don't issue RC4 session keys by default CVE-2025-3576 Resolves: RHEL-88047 Tenable has extracted the preceding description block directly from the Oracle Lin...

AlmaLinux 8 : kernel (ALSA-2025:9580)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:9580 advisory. kernel: cifs: fix double free race when mount fails in cifsgetroot CVE-2022-48919 kernel: security/keys: fix slab-out-of-bounds in keytaskpermission...

MAL-2025-5407 Malicious code in example-target-package (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9c527df8a6a7f920a0fd9146bf4a738da075f6430ad4a523d1c345fe4deb26b7 Any computer that has this package installed or running should be considered...

MAL-2025-5395 Malicious code in dynamic-importer2 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4468869b1899f5d6f33a0bb39a221a394f0d1fcce1dc46f3f2127636a40b500b Any computer that has this package installed or running should be considered...