AMD CPU ROM system loader Data Compromise

The vulnerability of AMD CPU ROM microprogramming software’s loader is related to errors in checking the cryptographic signature. Exploiting this vulnerability could allow an attacker to compromise the confidentiality and integrity of the protected information...

Cisco IOS XR Loader Bypass

The vulnerability of the Cisco IOS XR operating system’s loader is related to errors in verifying the cryptographic signature. Exploiting this vulnerability could allow a hacker to circumvent existing security restrictions...

Arbitrary Code Injection

Overview graphql is a plain-Ruby implementation of GraphQL. Affected versions of this package are vulnerable to Arbitrary Code Injection via the GraphQL::Schema.fromintrospection or GraphQL::Schema::Loader.load processes. An attacker can execute arbitrary code by loading a crafted GraphQL schema...

Important: Red Hat Security Advisory: grub2 security update

An update for grub2 is now available for Red Hat Enterprise Linux 9.4 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

U-Boot Heap Buffer Overflow DoS

The vulnerability of the sqfsinodesize function in the U-Boot loader is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

U-Boot loader Heap Buffer Overflow DoS

The vulnerability of the sqfsresolvesymlink function in the U-Boot loader is related to integer overflow. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

U-Boot Heap Buffer Overflow DoS

The vulnerability of the sqfssize function in the U-Boot loader is related to an uncontrolled recursion. Exploiting this vulnerability could allow a hacker to execute arbitrary code...

U-Boot Loader Heap Buffer Overflow DoS

The vulnerability of the ext4fsreadsymlink function in the U-Boot loader is related to a potential overflow condition. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected information...

U-Boot Loader Integer Overflow

The vulnerability of the U-Boot loader is related to a numerical overflow condition. Exploiting this vulnerability can allow an attacker to influence the confidentiality, integrity, and accessibility of the protected information...

Important: Red Hat Security Advisory: grub2 security update

An update for grub2 is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...

FIN7, FIN8, and Others Use Ragnar Loader for Persistent Access and Ransomware Operations

Threat hunters have shed light on a "sophisticated and evolving malware toolkit" called Ragnar Loader that's used by various cybercrime and ransomware groups like Ragnar Locker aka Monstrous Mantis, FIN7, FIN8, and Ruthless Mantis ex-REvil. "Ragnar Loader plays a key role in keeping access to...

SUSE CVE-2024-36347

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious microcode, potentially resulting in loss of integrity of x86 instruction execution, loss of confidentiality and integrity of data in x86 CPU privileged...

com.switchfly:gitlab-merge-request-jenkins (2.0.0), org.jenkins-ci.main:jenkins-test-harness (1.638) +4 more potentially affected by CVE-2025-27625 via org.jenkins-ci.main:jenkins-core (1.638)

org.jenkins-ci.main:jenkins-core MAVEN version 1.638 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 2.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.6...

com.switchfly:gitlab-merge-request-jenkins (2.0.0), org.jenkins-ci.main:jenkins-test-harness (1.638) +4 more potentially affected by CVE-2025-27624 via org.jenkins-ci.main:jenkins-core (1.638)

org.jenkins-ci.main:jenkins-core MAVEN version 1.638 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 2.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.6...

com.switchfly:gitlab-merge-request-jenkins (2.0.0), org.jenkins-ci.main:jenkins-test-harness (1.638) +4 more potentially affected by CVE-2025-27622 via org.jenkins-ci.main:jenkins-core (1.638)

org.jenkins-ci.main:jenkins-core MAVEN version 1.638 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.switchfly:gitlab-merge-request-jenkins 2.0.0 - org.jenkins-ci.main:jenkins-test-harness 1.6...

Linux Distros Unpatched Vulnerability : CVE-2022-27938

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - stbimage.h aka the stb image loader 2.19, as used in libsixel and other products, has a reachable assertion in stbicreatepngimageraw. CVE-2022-27938 Note that...

Embedded Malicious Code

Overview cdn-icon-fetcher-help is a Malicious package. Affected versions of this package are vulnerable to Embedded Malicious Code. Once this package is installed and executed, it downloads a Javascript file from a cdn-static-seven.vercel.app URL, which appears to be an image hosting site. Howeve...

Embedded Malicious Code

Overview cdn-icon-fetch is a Malicious package. Affected versions of this package are vulnerable to Embedded Malicious Code. Once this package is installed and executed, it downloads a Javascript file from a cdn-static-server.vercel.app URL, which appears to be an image hosting site. However, by...

Seven Malicious Go Packages Found Deploying Malware on Linux and macOS Systems

Cybersecurity researchers are alerting of an ongoing malicious campaign targeting the Go ecosystem with typosquatted modules that are designed to deploy loader malware on Linux and Apple macOS systems. "The threat actor has published at least seven packages impersonating widely used Go libraries,...

Linux Distros Unpatched Vulnerability : CVE-2022-37601

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all...