Craft CMS Code Injection Vulnerability

Craft CMS contains a code injection vulnerability caused by improper validation of the database backup path, ultimately enabling remote code execution...

MAL-2025-1484 Malicious code in gurubu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4e2206593db7db1c14c4f78386bcef91c603218c4c26feda8f080978f342cbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1496 Malicious code in sally-fn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d8f992872ff1926200839cd344c09dfc137f063e5f7e5f87f54d62b1d758202 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vulnerabilities fixed in Fortinet FortiSwitch, FortiManager, FortiAnalyzer, FortiOS and FortiProxy

Fortinet has fixed vulnerabilities in several products, including FortiOS, FortiProxy, FortiPAM, FortiSwitchManager, FortiSandbox, FortiManager and FortiAnalyzer. The vulnerabilities include the ability for privileged attackers to execute arbitrary code or commands by sending specially crafted...

Malicious code in bitstamp-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b47b2bc18b088e918e9f0a119c786790456bccd97013b5561c3a593b09b6d0ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1424 Malicious code in lbank-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af2e7b3d563cdc0ef10b52937250bae2ab41fce0d24fad93efa37fc06eab3d20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pionex-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f81458dd3260314fe07718ed1078e94e6d19a15e79f53216483eba4c0b3823a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in weex-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b584007c16319ecc4cbb0dadad514e12e33872b44707c476ea044b163bfc335e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1445 Malicious code in toobit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f762603da623d8fe137db26b48c17bb54cead19699d368690d433f939e45316f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1401 Malicious code in coinstore-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05d0767c1978fe4aea1d8d7ba69d0024d46e3bda1aafee9038125e6cfcdf0756 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1450 Malicious code in yizhifabao56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 491a20127b490163d052e3c42e4dbab76f309dc7148bc3d039b729882a4702f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1440 Malicious code in telegram-bot-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bfce13be8a817c4f8165b600702f49df73736a44741857d560aab26bfa00162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-25201

Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the...

OESA-2025-1124 etcd security update

%expand: Security Fixes: A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes...

SUSE CVE-2024-9355

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

CVE-2024-22588

Kwik commit 745fd4e2 does not discard unused encryption keys...

Oracle Linux 8 : container-tools:ol8 (ELSA-2025-1372)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-1372 advisory. aardvark-dns buildah 2:1.33.12-1 - update to the latest content of https://github.com/containers/buildah/tree/release-1.33...

MAL-2025-1360 Malicious code in dzengi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8119e05e44d286deeecdba85e6cf45a95749db4907cb770fa9828949f1fc347c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ts-plugin-file-path-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a29c99a3decf55fe58b9d10ce858b903ae55f7d999f98549a8416b4c12352e65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-6105

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database...