MAL-2025-63837 Malicious code in kresna-dodol52-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4976be4262d6d79f74353014c64d39f74fee0cc33d688b2ae38b2c549427c896 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62095 Malicious code in bella-tahu49-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 671cfad53c75a169ac44637e948df1bcbd3db306125f040a7c16c87bcd0c143e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-62972 Malicious code in fauzi-rojak5-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f5e0da1666494f88759c542c0503d469190f4832285c77f75fc6be822c6420c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64277 Malicious code in maya-kue47-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b98ec1522260b04edc6c81dad900da30bb400cb56b4ced5d7d2f512637aa865 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65912 Malicious code in vera-rojak45-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 749a352879c60c32d7079674e0c63a2f62886468e95aa4d538182d2468d93dc6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64833 Malicious code in public_starfish_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 448396d8217da33e850e24365dffcde9a7c485946e8cf7467c92363b69832a3c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63875 Malicious code in kurnia-ikan35-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58c2b043a2b995c309f9fd5ca7183db9400fc66306a4a9e09cd49e3f228e550b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64437 Malicious code in nadia-wajit88-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 344aede21c54cba2741ebd093731350b2c7ec280a01bebb5130e9a2fb5f67ca1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-65069 Malicious code in riana-tahu21-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e61dae989c40a509f15b9337a593bb1e8e1326e1d291d1a4cf9445e1b4b1c948 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64812 Malicious code in prepared_unicorn_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f207e43ebdb6bfec4f31653774dbb64f9ddd732d15d6a232a73350bff9f56f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-64310 Malicious code in maya-telurtahu19-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 274d9e15520a0b234231a4417f9df56abcc04bae8f37341fc9f4419298ac859d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-63916 Malicious code in kurniawan-klanting92-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ca5ff62e64b6d231fdcc309f6e83dd4817d0132467a2fa5e89ed94c12eb6d85 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SAP NetWeaver Application Server Java 路径遍历漏洞

SAP NetWeaver Application Server Java is an application server from SAP Germany that provides a Java runtime environment. The product is primarily used to develop and run Java EE applications. A path traversal vulnerability exists in SAP NetWeaver Application Server Java, which stems from the...

PT-2025-46238

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server Java affected versions not specified Description An information disclosure issue exists in SAP NetWeaver Application Server Java. An unauthenticated attacker can access internal metadata files through crafted...

QLCoder: A Query Synthesizer for Static Analysis of Security Vulnerabilities

Static analysis tools provide a powerful means to detect security vulnerabilities by specifying queries that encode vulnerable code patterns. However, writing such queries is challenging and requires diverse expertise in security and program analysis. To address this challenge, we present QLCoder...

CVE-2025-64522

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the webhook URLs which are not validated. An attacker can access internal services, private networks, or cloud metadata endpoints by configuring malicious webhook URLs. PoC ssh localhost webhook crea...

CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

CVE-2025-64522 Soft Serve is vulnerable to SSRF through its Webhooks

Soft Serve is a self-hostable Git server for the command line. Versions prior to 0.11.1 have a SSRF vulnerability where webhook URLs are not validated, allowing repository administrators to create webhooks targeting internal services, private networks, and cloud metadata endpoints. Version 0.11.1...

CVE-2025-64522

CVE-2025-64522 affects Soft Serve, a self-hosted Git server. The SSRF vulnerability arises from unvalidated webhook URLs, enabling repository admins to configure webhooks that target internal services, private networks, and cloud metadata endpoints. Affected components include Webhook Creation (p...