CVE-2025-7079

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebellbackend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plu...

CVE-2025-7079: Use of Hard-coded Password

A vulnerability, which was classified as problematic, has been found in mao888 bluebell-plus up to 2.3.0. This issue affects some unknown processing of the file bluebellbackend/pkg/jwt/jwt.go of the component JWT Token Handler. The manipulation of the argument mySecret with the input bluebell-plu...

Malicious code in simple-mali-pkg (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c9629656d765c03a690cd0d32598fac52e66c8f5c82dae9405280ee04e1b0280 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

Malware in requests-json-overview-pkg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in node-pkg-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6df8ca0c98ea357d77cecd453a9b679670af19bad2830fd82ee7cc85813b239c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5508 Malicious code in node-pkg-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6df8ca0c98ea357d77cecd453a9b679670af19bad2830fd82ee7cc85813b239c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in node-pkg-cache

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-5297 Malicious code in pkg-dev-deps-only (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 485d0ed1b5c95a60c68f04e0d03f68c9cb74cf2f0d2cc2181b99be5b1b8d7dc5 Any computer that has this package installed or running should be considered...

Malware in node-pkg-state

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4647 Malicious code in node-pkg-state (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0891ea1584d40cb7d6b9667931aaeee24089a5d7f605727e42f717b4b378682 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4436 Malicious code in fe-second-party-pkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bcbac1a3c8c63cd47005ab85c88ef2933e702844df4a607f5f54157c0a2881b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in fe-second-party-pkg

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-43970: Improper Validation of Specified Quantity in Input

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes depending on the address family...

CVE-2025-43972

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context...

CVE-2025-43972: Improper Validation of Specified Quantity in Input

An issue was discovered in GoBGP before 3.35.0. An attacker can cause a crash in the pkg/packet/bgp/bgp.go flowspec parser by sending fewer than 20 bytes in a certain context...

CVE-2025-43971: Off-by-one Error

An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen...

CVE-2025-43973

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...

CVE-2025-43970

An issue was discovered in GoBGP before 3.35.0. pkg/packet/mrt/mrt.go does not properly check the input length, e.g., by ensuring that there are 12 bytes or 36 bytes depending on the address family...

CVE-2025-43971

An issue was discovered in GoBGP before 3.35.0. pkg/packet/bgp/bgp.go allows attackers to cause a panic via a zero value for softwareVersionLen...

CVE-2025-43973: Off-by-one Error

An issue was discovered in GoBGP before 3.35.0. pkg/packet/rtr/rtr.go does not verify that the input length corresponds to a situation in which all bytes are available for an RTR message...