net.snowflake:snowflake-jdbc-thin (=4.0.0), org.apache.hadoop:hadoop-aws (=3.4.2) +6 more potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (>=3.1.1 <=3.5.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version =3.1.1, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.2 Source cves: CVE-2025-14763 Source advisory: OSV:GHSA-X44P-GVRJ-PJ2R...

net.snowflake:snowflake-jdbc-thin (=4.0.0), org.apache.hadoop:hadoop-aws (=3.4.2) +6 more potentially affected by CVE-2025-14763 via software.amazon.encryption.s3:amazon-s3-encryption-client-java (>=3.1.1 <=3.5.0)

software.amazon.encryption.s3:amazon-s3-encryption-client-java MAVEN version =3.1.1, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.0, =2.7.2 Source cves: CVE-2025-14763 Source advisory: SNYK:JAVA-SOFTWAREAMAZONENCRYPTIONS3-14465279...

MAL-2025-161873 Malicious code in nar-buntal-butya (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c457450e0f0dd69e4020f23b341f42c8efc462b69f63e4f41e6851f84780504a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2024-0948

Malicious code in bioql PyPI...

org.apache.kafka:kafka-perf_2.9.1 (>=0.8.0 <=0.8.0-beta1), org.apache.nifi:nifi-kafka-nar (>=0.4.0 <=0.4.1) +5 more potentially affected by CVE-2025-27819 via org.apache.kafka:kafka_2.9.1 (>=0.8.0-beta1 <=0.8.2.2)

org.apache.kafka:kafka2.9.1 MAVEN version =0.8.0-beta1, =0.8.0, =0.4.0, =0.4.0, =2.0-0-RC1, =2.0-0-RC1, =4.1.0, =4.1.1, =5.0.1 Source cves: CVE-2025-27819 Source advisory: OSV:GHSA-MCWH-C9PG-XW43...

org.apache.nifi.minifi:minifi-assembly (>=1.22.0 <=1.28.0), org.apache.nifi.minifi:minifi-c2-assembly (>=1.22.0 <=1.28.0) +22 more potentially affected by CVE-2024-52067 via org.apache.nifi:nifi-framework-core (>=1.16.0 <=1.28.0)

org.apache.nifi:nifi-framework-core MAVEN version =1.16.0, =1.22.0, =1.22.0, =1.22.0, =0.1.0, =0.1.0, =1.22.0, =1.22.0, =0.1.0, =0.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.1.2 and more Source cves: CVE-2024-52067 Source advisory: OSV:GHSA-V3VC-6QCV-4VRX...

org.apache.nifi:nifi-framework-nar (>=1.1.0 <=1.12.1), org.apache.nifi:nifi-jetty (>=1.1.0 <=1.15.3) +2 more potentially affected by CVE-2024-45477 via org.apache.nifi:nifi-web-ui (>=1.10.0 <=1.27.0)

org.apache.nifi:nifi-web-ui MAVEN version =1.10.0, =1.1.0, =1.1.0, =1.13.0, =1.11.0, =1.27.0 Source cves: CVE-2024-45477 Source advisory: OSV:GHSA-7MQJ-XGF8-P59V...

UBUNTU-CVE-2024-45593

Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...

CVE-2024-45593 Nix affected by unsafe NAR unpacking

Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...

CVE-2024-45593 Nix affected by unsafe NAR unpacking

Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...

CVE-2024-45845

Rejected reason: DO NOT USE THIS CVE RECORD. Consult IDs: CVE-2024-45593. Reason: This record is a reservation duplicate of CVE-2024-45593. Notes: All CVE users should reference CVE-2024-45593 instead of this record. All references and descriptions in this record have been removed to prevent...

CVE-2024-45845

...

CVE-2024-45845

...

CVE-2024-45845

CVE-2024-45593 relates to the Nix package manager. In affected releases prior to 2.24.6, a bug in Nix 2.24-era code allows a substituter or malicious user to craft a NAR that, when unpacked, can write to arbitrary file-system locations accessible to the Nix process, including with root privileges...

CVE-2024-45845

Removed by vendor...

org.apache.nifi:nifi-server-nar (=2.0.0-M3), org.apache.nifi:nifi-system-test-suite (>=2.0.0-M1 <=2.0.0-M3) potentially affected by CVE-2024-37389 via org.apache.nifi:nifi-web-ui (>=2.0.0-M1 <=2.0.0-M3)

org.apache.nifi:nifi-web-ui MAVEN version =2.0.0-M1, =2.0.0-M1, =2.0.0-M3 Source cves: CVE-2024-37389 Source advisory: OSV:GHSA-H658-QQV9-QWV8...

org.apache.nifi:nifi-framework-nar (>=1.1.0 <=1.12.1), org.apache.nifi:nifi-jetty (>=1.1.0 <=1.15.3) +2 more potentially affected by CVE-2024-37389 via org.apache.nifi:nifi-web-ui (>=1.10.0 <=1.26.0)

org.apache.nifi:nifi-web-ui MAVEN version =1.10.0, =1.1.0, =1.1.0, =1.13.0, =1.11.0, =1.26.0 Source cves: CVE-2024-37389 Source advisory: OSV:GHSA-H658-QQV9-QWV8...

CVE-2024-27317

In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files. These files, essentially zip files, are extracted by the Functions Worker. However, if a malicious file is uploaded, it could exploit a directory traversal vulnerability. This occurs when the filenames in th...

org.apache.nifi:nifi-kafka-connector-tests (>=1.14.0 <=1.23.2), org.apache.nifi:nifi-standard-nar (>=1.14.0 <=1.15.3) +4 more potentially affected by CVE-2023-49145 via org.apache.nifi:nifi-jolt-transform-json-ui (>=1.14.0 <=1.23.2)

org.apache.nifi:nifi-jolt-transform-json-ui MAVEN version =1.14.0, =1.14.0, =1.14.0, =1.15.0, =1.14.0, =1.23.2 - org.apache.plc4x:plc4j-nifi-plc4x-nar =0.10.0 - org.apache.plc4x:plc4j-nifi-plc4x-processors =0.10.0 Source cves: CVE-2023-49145 Source advisory: OSV:GHSA-68PR-6FJC-WMGM...

org.apache.nifi:nifi-jms-processors-nar (>=1.21.0 <=1.23.0) potentially affected by CVE-2023-40037 via org.apache.nifi:nifi-jms-processors (>=1.21.0 <=1.23.0)

org.apache.nifi:nifi-jms-processors MAVEN version =1.21.0, =1.21.0, =1.23.0 Source cves: CVE-2023-40037 Source advisory: OSV:GHSA-23QF-3JF9-H3Q9...