MAL-2025-6177 Malicious code in lint-pr-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7a7398205d96f4d045fedf2fbd41ba545c40048a2e9683747ab8bec7ac77a1f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in claude-pr-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78df9511839ca2f1261eadd3b5a9f886167ffbeb2e11f8d7c52f3470474d160e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-43801

Jellyfin is an open source self hosted media server. The Jellyfin user profile image upload accepts SVG files, allowing for a stored XSS attack against an admin user via a specially crafted malicious SVG file. When viewed by an admin outside of the Jellyfin Web UI e.g. via "view image" in a...

CVE-2014-125041

A vulnerability classified as critical was found in Miccighel PR-CWT. This vulnerability affects unknown code. The manipulation leads to sql injection. The patch is identified as e412127d07004668e5a213932c94807d87067a1f. It is recommended to apply a patch to fix this issue. VDB-217486 is the...

PT-2025-22227 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A kernel crash issue has been identified in the Linux kernel. The crash occurs when userspace invokes PR SET TAGGED ADDR CTRL, but the Supm extension is not available. This results in ...

CampCodes Sales and Inventory System 注入漏洞

CampCodes Sales and Inventory System is a sales and inventory system from CampCodes, Inc. The CampCodes Sales and Inventory System suffers from a SQL injection vulnerability that stems from the lack of validation of externally entered SQL statements in the parameter prid in the file...

MAL-2025-2607 Malicious code in gh-find-current-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0aba54c4eb36c259689cdca7db5a45c0b6cd53c7a27670e8a557c3b802afd97f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gh-find-current-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0aba54c4eb36c259689cdca7db5a45c0b6cd53c7a27670e8a557c3b802afd97f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in list-files-in-pr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2dec57d2d81d6a09a279dfc443753f7a1547d3c838aaf0ac20b735764a88c9b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: staticcall: Replace the unnecessary WARNON call in staticcallmodulenotify. staticcallmodulenotify triggers a WARNON when memory allocation fails in staticcalladdmodule. This approach isn’t really justified, because the failure ca...

CVE-2024-53167

CVE-2024-53167 affects the Linux kernel NFS client’s blocklayout path. The issue arises during unmount of a pNFS SCSI layout when a NULL block_device is dereferenced due to premature PR key unregistration; the code may unregister a device when none is attached. The root cause is a failure to guar...

MAL-2024-11196 Malicious code in set-pr-description-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f56192a6739bfa4e2f9794840d334d8216ea18d4086cf066b6eeded90d8bbfb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

6 non tech things you wish you had done before being breached

Introduction When a breach happens, it’s not just technical defences that matter. Preparation in non-technical areas, like having key documents printed or emergency contacts accessible, can make all the difference. In this blog, we highlight six simple yet essential steps to help you prepare in...

BIT-CILIUM-OPERATOR-2024-52529 Layer 7 policy enforcement may not occur in policies with wildcarded port ranges in Cilium

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. For users with the following configuration: 1. An allow policy that selects a Layer 3 destination and a port range AND 2. A Layer 7 allow policy that selects a specific port within the first policy's range...

CVE-2024-53267

sigstore-java (the Java client) is affected by a vulnerability where KeylessVerifier.verify() may accept a validly-signed but mismatched bundle as proof of inclusion in a transparency log. The log-entry could be unrelated to the artifact, allowing a bundle to appear logged without proof the signi...

CVE-2024-53267 Vulnerability with bundle verification in sigstore-java

sigstore-java is a sigstore java client for interacting with sigstore infrastructure. sigstore-java has insufficient verification for a situation where a validly-signed but "mismatched" bundle is presented as proof of inclusion into a transparency log. This bug impacts clients using any variation...

GLASSBRIDGE: Google Blocks Thousands of Pro-China Fake News Sites

Google reveals GLASSBRIDGE: A network of thousands of fake news sites pushing pro-China narratives globally. These sites, run by PR firms, spread disinformation and lack transparency...

How to handle vulnerability reports in aviation

TL;DR Always thank researchers for reporting vulnerabilities. Acknowledging their efforts can set the right tone. Lead all communications with researchers. Don’t let legal or PR teams take over. Provide regular updates to avoid miscommunication. Keep researchers informed throughout the process. W...

GHSA-4F8R-QQR9-FQ8J Incorrect delegation lookups can make go-tuf download the wrong artifact

During the ongoing work on the TUF conformance test suite, we have come across a test that reveals what we believe is a bug in go-tuf with security implications. The bug exists in go-tuf delegation tracing and could result in downloading the wrong artifact. We have come across this issue in the...

Metasploit Weekly Wrap-Up 09/06/2024

Honey, I shrunk the PHP payloads This release contains more PHP payload improvements from Julien Voisin. Last week we landed a PR from Julien that added a datastore option to the php/base64 encoder that when enabled, will use zlib to compress the payload which significantly reduced the size,...