Vulnerabilities fixed in Fortinet FortiSwitch, FortiManager, FortiAnalyzer, FortiOS and FortiProxy

Fortinet has fixed vulnerabilities in several products, including FortiOS, FortiProxy, FortiPAM, FortiSwitchManager, FortiSandbox, FortiManager and FortiAnalyzer. The vulnerabilities include the ability for privileged attackers to execute arbitrary code or commands by sending specially crafted...

Malicious code in bitstamp-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b47b2bc18b088e918e9f0a119c786790456bccd97013b5561c3a593b09b6d0ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1424 Malicious code in lbank-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af2e7b3d563cdc0ef10b52937250bae2ab41fce0d24fad93efa37fc06eab3d20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pionex-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f81458dd3260314fe07718ed1078e94e6d19a15e79f53216483eba4c0b3823a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in weex-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b584007c16319ecc4cbb0dadad514e12e33872b44707c476ea044b163bfc335e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1445 Malicious code in toobit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f762603da623d8fe137db26b48c17bb54cead19699d368690d433f939e45316f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1401 Malicious code in coinstore-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05d0767c1978fe4aea1d8d7ba69d0024d46e3bda1aafee9038125e6cfcdf0756 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1450 Malicious code in yizhifabao56 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 491a20127b490163d052e3c42e4dbab76f309dc7148bc3d039b729882a4702f2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1440 Malicious code in telegram-bot-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bfce13be8a817c4f8165b600702f49df73736a44741857d560aab26bfa00162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-25201

Nitrokey 3 Firmware is the the firmware of Nitrokey 3 USB keys. For release 1.8.0, and test releases with PIV enabled prior to 1.8.0, the PIV application could accept invalid keys for authentication of the admin key. This could lead to compromise of the integrity of the data stored in the...

OESA-2025-1124 etcd security update

%expand: Security Fixes: A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes...

SUSE CVE-2024-9355

A vulnerability was found in Golang FIPS OpenSSL. This flaw allows a malicious user to randomly cause an uninitialized buffer length variable with a zeroed buffer to be returned in FIPS mode. It may also be possible to force a false positive match between non-equal hashes when comparing a trusted...

CVE-2024-22588

Kwik commit 745fd4e2 does not discard unused encryption keys...

Oracle Linux 8 : container-tools:ol8 (ELSA-2025-1372)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-1372 advisory. aardvark-dns buildah 2:1.33.12-1 - update to the latest content of https://github.com/containers/buildah/tree/release-1.33...

MAL-2025-1360 Malicious code in dzengi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8119e05e44d286deeecdba85e6cf45a95749db4907cb770fa9828949f1fc347c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ts-plugin-file-path-support (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a29c99a3decf55fe58b9d10ce858b903ae55f7d999f98549a8416b4c12352e65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-6105

An information disclosure vulnerability exists in multiple ManageEngine products that can result in encryption keys being exposed. A low-privileged OS user with access to the host where an affected ManageEngine product is installed can view and use the exposed key to decrypt product database...

Malicious code in bingx-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f92aa788d9b5268cd851c4d7c893d68e617a87955595f91059e2c09e201706ac Any computer that has this package install...

container-tools:ol8 security update

aardvark-dns buildah 2:1.33.12-1 - update to the latest content of https://github.com/containers/buildah/tree/release-1.33 https://github.com/containers/buildah/commit/58af1cd - Resolves: RHEL-67612 cockpit-podman conmon containernetworking-plugins containers-common 1-82.0.1 - Updated removed...

Mageia: Security Advisory (MGASA-2025-0054)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...