6815 matches found
MAL-2025-186622 Malicious code in dotenv-safe-nodemon-ariel-petrology (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0dd10bc2cfa24ccde592a913acc6858967290e29bf81dfa4d634d6c08921764 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179650
Malicious code in command-dotenv-safe-oberon-lint-staged npm...
EUVD-2022-55678
DBLTek GoIP-1 firmware versions up to and including GHSFVT-1.1-67-5 contain a local file inclusion vulnerability. The device's web server exposes handlers frame.html and frame.A100.html that accept a path parameter content or sidebar which is not properly validated or canonicalized. An attacker c...
CVE-2025-60700
A command injection vulnerability exists in the D-Link DIR-882 Router firmware (version DIR882A1_FW102B02 ) within the prog.cgi and librcm.so binaries. The root cause is a lack of input sanitization where the sub_4455BC function in prog.cgi stores user-supplied SetDMZSettings/IPAddress values in ...
ROS-20251113-01
A vulnerability in the Omnibox component of the Google Chrome and Microsoft Edge browsers is related to writing outside the boundaries of the buffer. Exploitation of the vulnerability could allow an attacker acting remotely to escalate their privileges A vulnerability in the Safe Browsing compone...
CVE-2025-40168
The CVE-2025-40168 issue affects the Linux kernel in the smc_clc_prfx_match() function (net/smc/smc_clc.c); it can cause a use-after-free when dst_entry is handled outside RCU/RTNL. The recommended fix is to use __sk_dst_get() and dst_dev_rcu() to obtain the destination device. The vulnerability ...
CVE-2025-40168 smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match().
In the Linux kernel, the following vulnerability has been resolved: smc: Use skdstget and dstdevrcu in smcclcprfxmatch. smcclcprfxmatch is called from smclistenwork and not under RCU nor RTNL. Using skdstgetsk-dev could trigger UAF. Let's use skdstget and dstdevrcu. Note that the returned value o...
CVE-2025-40154
The CVE-2025-40154 entry concerns the ASoC: Intel bytcr_rt5640 driver. The vulnerability arises from an invalid quirk input mapping; when an invalid value is passed, the driver previously reported an error but retained the input, potentially causing out-of-bounds (OOB) access. A fix in the Linux ...
EUVD-2025-124768
Malicious code in mongoose-dotenv-safe-fornax-xerxes npm...
Malicious code in fornax-dotenv-safe-delphinus-kronos (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 642878f7ea02757310af6a4a32229ef548b1d47085028952b7c4f950221c7adb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-114360
Malicious code in dotenv-safe-dotenv-safe-proxima-juno npm...
EUVD-2025-124675
Malicious code in mysql-dactyl-dotenv-safe-sadr npm...
EUVD-2025-112976
Malicious code in halley-dotenv-safe-rehype-cross-env npm...
EUVD-2025-111660
Malicious code in lint-staged-dotenv-safe-pulsar-restart npm...
EUVD-2025-111621
Malicious code in local-prompts-webdriver-mocha-dotenv-safe npm...
Malicious code in eris-nightwatch-axios-dotenv-safe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efbbeee471022a3f37436f04cb109e877e4866d40b6368dc49dd3f4aac44dd96 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-123642
Malicious code in playwright-cressida-rehype-dotenv-safe npm...
EUVD-2025-123997
Malicious code in package-await-dotenv-safe-acamar npm...
Malicious code in tool-dotenv-safe-deimos-magellan (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53dd26ce16209c77a21640e06bf2d7589940321cc0ca582d08066c674a8639be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...