MAL-2025-49000 Malicious code in express-redact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4f7506bc61afb104333b21673f4899d6ea5e6982fcb1be7623fafcb4f5580a7 The package express-redact was found to contain malicious code. Source: ghsa-malware a883eba91191de6920dc8a2f765112365ac2835f16dd0918d3750d99a89cc9e9...

EUVD-2025-36848

Malicious code in express-redact npm...

EUVD-2025-31052

Malicious code in bioql PyPI...

GHSA-FFRW-9MX8-89P8 Withdrawn Advisory: fast-redact vulnerable to prototype pollution

Withdrawn Advisory This advisory has been withdrawn because the issue uses an internal undocumented utility function. This link is maintained to preserve external references. Original Description fast-redact is a package that provides do very fast object redaction. A Prototype Pollution...

Withdrawn Advisory: fast-redact vulnerable to prototype pollution

Withdrawn Advisory This advisory has been withdrawn because the issue uses an internal undocumented utility function. This link is maintained to preserve external references. Original Description fast-redact is a package that provides do very fast object redaction. A Prototype Pollution...

CVE-2025-57319

fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS ...

CVE-2025-57319

fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS ...

CVE-2025-57319

fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS ...

PT-2025-39349

Name of the Vulnerable Software and Affected Versions fast-redact versions prior to 3.5.0 Description A Prototype Pollution issue exists in the nestedRestore function of fast-redact. Attackers can inject properties onto Object.prototype by providing a crafted payload. This can lead to a denial of...

CVE-2025-57319

CVE-2025-57319 corresponds to a Prototype Pollution in the nestedRestore function of the fast-redact package (versions up to 3.5.0). The IBM security entries confirm multiple advisories stating this vulnerability can enable DoS by polluting Object.prototype, with the Supplier dispute noted in the...

fast-redact 安全漏洞

fast-redact is an object editing library by the individual developer David Mark Clements. A security vulnerability exists in fast-redact 3.5.0 and earlier versions, which stems from prototype contamination in the nestedRestore function and could lead to a denial of service attack...

CVE-2025-57319

fast-redact is a package that provides do very fast object redaction. A Prototype Pollution vulnerability in the nestedRestore function of fast-redact version 3.5.0 and before allows attackers to inject properties on Object.prototype via supplying a crafted payload, causing denial of service DoS ...

Jenkins exposes multi-line secrets through error messages

Jenkins Jenkins provides the secretTextarea form field for multi-line secrets. Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field. This can result in exposure of...

CVE-2024-47803

Jenkins 2.478 and earlier, LTS 2.462.2 and earlier does not redact multi-line secret values in error messages generated for form submissions involving the secretTextarea form field...

GO-2024-3093 Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server

Mattermost doesn't redact remote users' original email addresses in github.com/mattermost/mattermost-server...

CVE-2024-32939 Email addresses of remote users visible in props regardless of server settings

Mattermost versions 9.9.x = 9.9.1, 9.5.x = 9.5.7, 9.10.x = 9.10.0, 9.8.x = 9.8.2, when shared channels are enabled, fail to redact remote users' original email addresses stored in user props when email addresses are otherwise configured not to be visible in the local server."...

Elastic Agent 8.15.0 Security Update (ESA-2024-23)

Elastic Agent Insertion of Sensitive Information into Log File ESA-2024-23 An issue was discovered whereby Elastic Agent will leak secrets from the agent policy elastic-agent.yml only when the log level is configured to debug. By default the log level is set to info, where no leak occurs. Affecte...

CVE-2024-32028 Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore

OpenTelemetry dotnet is a dotnet telemetry framework. In affected versions of OpenTelemetry.Instrumentation.Http and OpenTelemetry.Instrumentation.AspNetCore the url.full writes attribute/tag on spans Activity when tracing is enabled for outgoing http requests and...

Sensitive query parameters logged by default in OpenTelemetry.Instrumentation http and AspNetCore

Impact OpenTelemetry.Instrumentation.Http writes the url.full attribute/tag on spans Activity when tracing is enabled for outgoing http requests and OpenTelemetry.Instrumentation.AspNetCore writes the url.query attribute/tag on spans Activity when tracing is enabled for incoming http requests...

BIT-MATTERMOST-2023-1831

Mattermost fails to redact from audit logs the user password during user creation and the user password hash in other operations if the experimental audit logging configuration was enabled ExperimentalAuditSettings section in config...