Malicious code in commitlint-readable-standard-levels (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ee74897cb470305c5a181b7888799edaf5856fa3361abf88d8a8e2f0f78bbb80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146119 Malicious code in perseus-tailwindcss-sagitta-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe718078873d5a61ddb4eb1d9bf6a74722c114987d641c9b5a9f4a5a7d467c0b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-146621 Malicious code in procyon-transport-antares-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0dd5e963ca95be4d275776c26fe8bbf0e69bad83e16e6477c525e3b11082bb9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-145938 Malicious code in package-luna-prettier-plugin-markdown-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b75efe02b19ff9ec70cbd27c5dc3b7ff7f2efe7c12ee542ff0ba4d8f933f0cf7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-111801

Malicious code in less-json-sync-readable npm...

EUVD-2025-111187

Malicious code in meteor-readable-dactyl-chalk npm...

MAL-2025-140520 Malicious code in celeste-remark-readable-rocket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 724e457d8f4a5cdd399e63be6f869bbfb4f00b98106d11925fdc6580ac65bf57 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-111965

Malicious code in kaus-local-readable-csv npm...

EUVD-2025-115964

Malicious code in browserify-readable-mysql-standard npm...

EUVD-2025-114943

Malicious code in corvus-readable-cluster-yonder npm...

EUVD-2025-115965

Malicious code in browserify-readable-kaus-dione npm...

Malicious code in spinner-envconfig-regulus-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f3094685581e8535286d53ba4a65d093b12a027d9f305edb393fc8e9a267df3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-148509 Malicious code in terser-atlas-figures-readable (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d5adb748096ba778ee5999d50c614c52e7e276480ebb02aa4b345857a837b99e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2024-32010

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...

CVE-2024-32010

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...

CVE-2024-32010

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...

PT-2025-46535

Name of the Vulnerable Software and Affected Versions Spectrum Power versions prior to 4.70 SP12 Update 2 Description The application is susceptible to the exposure of database credentials through a world-readable credential file. Successful exploitation allows an attacker to connect to the...

curl: curl’s persistence files inherit world-readable/writable perms from umask, leaking and tampering with cookies/HSTS/Alt-Svc caches

Executive Summary Curlfopen clones the permissions of any pre-existing persistence file when creating its temporary file. When the persistence file does not exist, it first creates one with the process umask typically 022, i.e., 0644. That mode is then copied to the temp file via 0600 | sb.stmode...

CVE-2025-54808

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory /tmp on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the...

CVE-2025-54808 Oxford Nanopore Technologies MinKNOW Insufficiently Protected Credentials

Oxford Nanopore Technologies' MinKNOW software at or prior to version 24.11 stores authentication tokens in a file located in the system's temporary directory /tmp on the host machine. This directory is typically world-readable, allowing any local user or application to access the token. If the...