MAL-2025-138717 Malicious code in fascinating-coral-marlin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1c8f65e9fdaf8502289c4e3097788b192701db6d4ed046852d818449c6ab10a4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

libtiff: Libtiff Write-What-Where

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the library into writing attacker-controll...

kernel: fs: fix UAF/GPF bug in nilfs_mdt_destroy

In the Linux kernel, the following vulnerability has been resolved: fs: fix UAF/GPF bug in nilfsmdtdestroy In allocinode, inodeinitalways could return -ENOMEM if securityinodealloc fails, which causes inode-iprivate uninitialized. Then nilfsismetadatafileinode returns true and nilfsfreeinode...

CVE-2025-42919

Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the request, allowing unauthorized access...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-2370)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some fil...

CVE-2025-27368: Exposure of Sensitive System Information to an Unauthorized Control Sphere

IBM OpenPages 9.0 and 9.1 is vulnerable to information disclosure of sensitive information due to a weaker than expected security for certain REST end points used by the user interface of OpenPages. An authenticated user is able to obtain certain information about system metadata for areas beyond...

PT-2025-46693

Name of the Vulnerable Software and Affected Versions IBM OpenPages versions 9.0 through 9.1 Description IBM OpenPages versions 9.0 and 9.1 have a security issue that could lead to the disclosure of sensitive information. This is due to insufficient security measures on certain REST API endpoints...

EulerOS 2.0 SP12 : python3 (EulerOS-SA-2025-2339)

According to the versions of the python3 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some fil...

MAL-2025-132294 Malicious code in brainy_lemur_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 678d9b348696f0d98fe04d73abd552d42247e07fb8f26f5bed088796b464df0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gita-gandul80-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9bb0d85faaf693a8e75828beb37e2c48106eeeea1215207afbb0834e235ac676 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ok_fox_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 46cf3a6faf59fa6785996986ff0be567ffc6443ff4c9728f9f76b0c830ecb93e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nana-takokak15-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7bf63332fa47767c8c10dab12532c3018c5845f3829d57af0916b48c7670d024 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in erick-ongol-ongol19-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87ceb83df9603b0e1e7662e4be5714c0a85d7027d20c001e19c93e86c67413c4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in advisory_pheasant_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 62a38b8d1fc99b03741752ce8263f3f8f4013fd20d47b6d1d246eb127909f0b2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nana-kentang82-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9c6bed8a265644246466391301f3703a02f0a749059776572e099ecb09a7211d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in dian-empal58-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5f90fca42aa4f901eac949da3e025deab773192bf543593bbdcc3fdd135885a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in serious_gorilla_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 449e5b1e2a25501e9fb59fd8e1bc047cfee2c37f51dcf77b69069d81fc9f7198 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in gilang-donat12-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 32da3d6ef4265d4d4618adbf11d22d961e5771c1cf7d86b926b38c0506400991 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hadi-sate60-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b223a79028294d4b43209ccef30b45eceffcff7b4aa6ef2f9362ca1b36b231ab This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bad_cicada_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 04a38fcac952821b5956c208cb3b4e96539c3c97133a601f76c2bbccb37763f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...