MAL-2025-59 Malicious code in appboy-web-sdk-v2 (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e0c15da90dc72a0bf53f2dccb6e0419535a29d50e59fb3de4b5fb7a2f72245ea Any computer that has this package install...

Security Bulletin: Multiple Vulnerabilities of IBM Java SDK have affected Linux KVM Agent from IBM Tivoli Monitoring for Virtual Environments product

Summary Linux KVM Agent is from IBM Tivoli Monitoring for Virtual Environments product vulnerable to IBM java SDK. The fix includes IBM Java SDK upgraded to 8.0.8.25. Vulnerability Details CVEID:CVE-2024-20952 DESCRIPTION: An unspecified vulnerability in Java SE related to the Security component...

Security Bulletin: Multiple Vulnerabilities of IBM Java SDK have affected VMware Agent from IBM Tivoli Monitoring for Virtual Environments product

Summary VMware Agent from IBM Tivoli Monitoring for Virtual Environments product is vulnerable to IBM java SDK. The fix includes IBM Java SDK upgraded to 08.08.25.00 version. Vulnerability Details CVEID:CVE-2023-22081 DESCRIPTION: An unspecified vulnerability in Java SE related to the JSSE...

MAL-2025-3 Malicious code in safe-apps-react-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4844f797621f2cd62b20851643278b7d27cfc2ca46fdd1485383cd7818d5c0a8 Any computer that has this package install...

PT-2025-38058

Name of the Vulnerable Software and Affected Versions: matrix-js-sdk versions prior to 38.2.0 Description: The Matrix JavaScript SDK has insufficient validation of room predecessor links in the MatrixClient::getJoinedRooms function, potentially allowing a remote attacker to replace a tombstoned...

Malicious code in vscode-dotnet-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24b8e33604973dbb3009563bb44c06e76ba342d0a691e0ecb3341e94dadc47e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12128 Malicious code in vscode-dotnet-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24b8e33604973dbb3009563bb44c06e76ba342d0a691e0ecb3341e94dadc47e2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-56201 vulnerabilities

Vulnerabilities for packages: kubeflow-volumes-web-app, airflow, nemo, kserve, localstack, kubeflow-jupyter-web-app, ansible-operator, py3-jinja2, apache-beam-python-3.11-sdk, reflex, superset, dask-gateway, checkov, emissary, mlflow...

Security Bulletin: Multiple vulnerabilities may affect IBM® SDK, Java™ Technology Edition for IBM Content Collector for SAP Applications

Summary Multiple Vulnerabilities were disclosed as part of the Oracle July 2024 Critical Patch Update Vulnerability Details CVEID:CVE-2024-21147 DESCRIPTION: An unspecified vulnerability in Java SE related to the VM component could allow a remote attacker to cause high confidentiality, high...

Ivanti Patch SDK Permission Issues Vulnerability

Ivanti Patch SDK is a security tool development kit provided by Ivanti to help organizations automate system vulnerability remediation and patch management. Ivanti Patch SDK suffers from a privilege issue vulnerability that stems from insufficient privileges. An attacker could exploit this...

Updated thunderbird packages fix security vulnerability

Matrix-js-sdk has insufficient MXC URI validation which could allow client-side path traversal. CVE-2024-50336...

MGASA-2024-0395 Updated thunderbird packages fix security vulnerability

Matrix-js-sdk has insufficient MXC URI validation which could allow client-side path traversal. CVE-2024-50336...

SUSE CVE-2020-8912

A vulnerability in the in-band key negotiation exists in the AWS S3 Crypto SDK for GoLang versions prior to V2. An attacker with write access to the targeted bucket can change the encryption algorithm of an object in the bucket, which can then allow them to change AES-GCM to AES-CTR. Using this i...

The many ways to obtain credentials in AWS

Dive into the complexities of AWS IAM credentials and uncover how defenders can stay ahead with in-depth knowledge of SDK behaviors and service-specific mechanisms...

FBX SDK < 2020.3.5 Out-of-Bounds Write (adsk-sa-2023-0025)

The version of FBX SDK installed on the remote host is prior to 2020.3.5. It is, therefore, affected by a vulnerability as referenced in the adsk-sa-2023-0025 advisory. - A maliciously crafted FBX file, when parsed through Autodesk FBX SDK, may force an Out-of-Bounds Write vulnerability. A...

CVE-2024-7139 Denial of Service in Silicon Labs RS9116 Bluetooth SDK

Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service. If a watchdog timer is not enabled, a hard reset is required to recover the device...

CVE-2024-7139 Denial of Service in Silicon Labs RS9116 Bluetooth SDK

Due to an unchecked buffer length, a specially crafted L2CAP packet can cause a buffer overflow. This buffer overflow triggers an assert, which results in a temporary denial of service. If a watchdog timer is not enabled, a hard reset is required to recover the device...

CVE-2024-7139

The CVE-2024-7139 entry concerns Silicon Labs RS9116 Bluetooth SDK. The issue is caused by an unchecked buffer length in L2CAP processing, allowing a buffer overflow that triggers an assertion and leads to a temporary denial of service. The impact is a DoS, with a potential required hard reset to...

CVE-2024-7138

CVE-2024-7138 affects Silicon Labs RS9116 Bluetooth SDK. A software assertion can trigger when a peer sends specially crafted malformed L2CAP packets, causing a temporary denial of service. If a watchdog timer is not enabled, recovery may require a hard reset of the device. Documents consistently...

CVE-2024-7138 Denial of Service in Silicon Labs RS9116 Bluetooth SDK

An assert may be triggered, causing a temporary denial of service when a peer device sends a specially crafted malformed L2CAP packet. If a watchdog timer is not enabled, a hard reset is required to recover the device...