git-lfs: Git LFS may write to arbitrary files via crafted symlinks

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...

rsync: Path traversal vulnerability in rsync

A path traversal vulnerability exists in rsync. It stems from behavior enabled by the --inc-recursive option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the --inc-recursive option, a lack of proper...

git-lfs: Git LFS may write to arbitrary files via crafted symlinks

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...

webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser...

AlmaLinux 8 : python39:3.9 (ALSA-2025:23530)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2025:23530 advisory. python: Invalid value for OpenSSL API may cause Buffer over-read when NPN is used CVE-2024-5642 python: Virtual environment venv activation scripts don't...

MAL-2025-192661 Malicious code in adel-xnetgpt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f85b321aa51079c32d9640eb5619d6350f409dc14f26141a99a5744932ddee14 The package adel-xnetgpt was found to contain malicious code. Source: ghsa-malware 0ebdfb3056af9b8e58d8ce4bc938a77b985744ece2a3de14f4b691d2b97ca3ad A...

Malicious code in baidu-tester (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 421c0014ea5fca29effc2b5cc0a04d984b9c2d557496c3ae31a5724ab6337417 The package baidu-tester was found to contain malicious code. Source: ghsa-malware e3d13abe3b7037aa5d2906857e05ea0f19837a22cf3563951cf23717228d15b2 A...

Malicious code in vdous (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 287389231a3c89843cda42ba76c0357e0f1e933cd479a9e12621a250e7014980 The package vdous was found to contain malicious code. Source: ghsa-malware db289bbb4a097deab7e11457a14affb9e2579bda9632d94fba4110f60b48ae63 Any...

Malicious code in yt-smm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3641ecf42237a55c9fb81c4368aa7b83a42d2110a64a733f45d27005cf38dc26 The package yt-smm was found to contain malicious code. Source: ghsa-malware b4d96978cd4e109ed8b360f551af24fd1621dd659f63a490c9de077b587f607b Any...

Malicious code in viktorparserctf3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48c2840e0c17dd93d7212fbf45f44cc176dab955745be97cc722dbf28f642cbd The package viktorparserctf3 was found to contain malicious code. Source: ghsa-malware 70fd554f1378b0035e48dd211debb57d92eb88e7548b4e441993571ffd7b89...

Malicious code in test-mal-npm-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 60f6f3e205b514fc5d9c6e98be4d3b0bf7049c38a0ff62e678584aaff50fc643 The package test-mal-npm-pkg was found to contain malicious code. Source: ghsa-malware d97b7f5012899a502ba9d154bc5f146717e56795f702823294ea3636b433c7...

Malicious code in hubstyletokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 270a762e8fe2aca75314b8b673b01068f64424cb56d5442954e0c44119475dff The package hubstyletokens was found to contain malicious code. Source: ghsa-malware b315d930157f2b1fd1b14cddfbd3f09759c6b275da5b51570eadff87cadf27b8...

Malicious code in tailwind-color-shine (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a354c1527256b0cbb0309429b90ad036ded6b2cc1b2d29b8f2809af26f718cf7 The package tailwind-color-shine was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192627 Malicious code in elf-stats-sugarplum-fir-770 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba9b8e626ecf42f5770535353dad46da3dbae1b468a54040b1024c069ead0f72 The package elf-stats-sugarplum-fir-770 was found to contain malicious code. Source: ghsa-malware...

Malicious code in chai-async (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b74105dd25d6c4527e469282746ab5847ca41c5f21873099aa73bcf848f99432 The package chai-async was found to contain malicious code. Source: ghsa-malware 5eadd1bc38807a3c5bcec1c37a5d1a1de8bf81bfed4a5a7ba235a1e6f8ec34aa Any...

MAL-2025-192614 Malicious code in react-enhanced-glow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d6a21a6e0e2094ca1f9327d83a0c38da77bd3b8f8ffbad317ef4530a7d14c45 The package react-enhanced-glow was found to contain malicious code. Source: ghsa-malware...

CVE-2023-53944

EasyPHP Webserver 14.1 is affected by a path traversal vulnerability (CVE-2023-53944) that allows remote low-privilege users to read files outside the document root by bypassing SecurityManager. The documented payload involves crafted GET requests with encoded directory traversal sequences such a...

git-lfs: Git LFS may write to arbitrary files via crafted symlinks

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...

git-lfs: Git LFS may write to arbitrary files via crafted symlinks

A flaw was found in Git LFS. Running git lfs checkout and git lfs pull in a specially crafted repository, specifically with symbolic or hard links tracked by Git LFS and pointing to files outside the working tree or in a bare repository, can cause Git LFS to write to arbitrary file system locatio...

webkit: WebKitGTK: Remote user-assisted information disclosure via file drag-and-drop

A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations originate from outside the browser...