CVE-2025-69217

coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RANDbytes but libc's random if it's not runni...

CVE-2025-69217

CVE-2025-69217 pertains to coturn (TURN/STUN server). Affected releases: 4.6.2r5–4.7.0-r4 have a weak RNG for nonces and port randomization due to a refactor, using libc random() instead of OpenSSL RAND_bytes (non-Windows). Attacking with ~50 consecutive unauthenticated nonce requests can reconst...

CVE-2025-69217: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

coturn is a free open source implementation of TURN and STUN Server. Versions 4.6.2r5 through 4.7.0-r4 have a bad random number generator for nonces and port randomization after refactoring. Additionally, random numbers aren't generated with openssl's RANDbytes but libc's random if it's not runni...

Nintendo: ASLR leak in Mario Kart World through LAN mode

A vulnerability was discovered in the LAN mode of Mario Kart World that allowed an ASLR leak. This vulnerability was found in the game's software...

Advisory ROSA-SA-2025-3103

Software: rsync 3.1.3 OS: ROSA Virtualization 2.1 packageevrstring: rsync-3.1.3-20.rv3 CVE-ID: CVE-2022-37434 BDU-ID: 2022-05325 CVE-Crit: CRITICAL. CVE-DESC.: A vulnerability in the inflate.c component of the zlib library is related to an operation exceeding buffer boundaries in memory...

Logic Encryption: This Time for Real

Modern circuits face various threats like reverse engineering, theft of intellectual property IP, side-channel attacks, etc. Here, we present a novel approach for IP protection based on logic encryption LE. Unlike established schemes for logic locking, our work obfuscates the circuit's structure...

Mozilla Firefox < 51.0

The version of Firefox installed on the remote Windows host is prior to 51.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-01 advisory. - A use-after-free vulnerability in the Media Decoder when working with media files when some events are fired after the...

MAL-2025-189232 Malicious code in rho-mu-catch-double-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ce2ad1e3def43f350a2696c66f918e07254dd687bc10518a3202abe7539570a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in neutronstar-regulus-sqlite-stratosphere (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd76a2dd4b6f1c8374b68d6f578a4c53895f8cdc8fad0504324a71a8377a5e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spectron-webdriver-async-primatology-canopus (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4810ee66c68692cb4e0793f469d0d3874bbb2255c23b0dd696e904d2e43f0c2d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in xenos-xanthus-celeste-react-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1e905ee031b2c4ef7912618f1d64a99f35e6da479055f1504c5b29a0adaac500 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Siemens SIMATIC S7-1500 Improper Initialization (CVE-2019-19126)

On the x86-64 architecture, the GNU C Library aka glibc before 2.31 fails to ignore the LDPREFERMAP32BITEXEC environment variable during program execution after a security transition, allowing local attackers to restrict the possible mapping addresses for loaded libraries and thus bypass ASLR for...

Malicious code in lomi-fus-ufga (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 17f08929474537932dc80c444136c187398bdff543d264e0b503d48dd3e2c26f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in goiy-ng-gufaguaguaufafci (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b99fe4b884f047aa23b6688d9246391637e01df6d89f59fdc568447c37c866fc This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-179753 Malicious code in kiut-acog-aef (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4aaf6a2e0fdc7a58f138e94cd93846451a9ed8c4345ad429aaa3635526f4f49 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in hunimi-sathu-an (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 576cef02a062cf4eaab44100af0a0f5df0c8d84187cd2b9a149534202e67bd53 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in kapino-samnvu-ubdibi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7947f3abd4e6a7ed0d255d016ff7b79e3677fdd18920188545b0529b0b99c2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-174341 Malicious code in goodafin-nui-nutuygagi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8070e46baa68e0f7081370ee773534340e624b70d4b826a0230837f0bcab7f4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-178614 Malicious code in sahunim-satudui-fadabidantu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8bb5d9642f63e7f1bdc5bdf05c0323c116eacc69bfd09eed7bf840b7851f5d67 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176165 Malicious code in miusan-faud-aneraf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 73f9d866572064c6a43b943b8200610cd1ec30ff7f859d0801881c272d9a790d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...