MAL-2026-14304 Malicious code in base99-85x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92b7a4319eaf4f75e0e4138802a61018a4016e0b1ff69e9e8eab51eeb01a240d base99-85x is a typosquat of the base-x encoding library. Its main export's decode function POSTs every caller-supplied string, as JSON "text": , to...

Malicious code in @zzzgenesis00/env-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cfbfc9bcbea1e1b9d6c52e2585bf5b28064fe8e38fe53304450fe1fd19340f3b On npm install, postinstall.js reads installer-owned secret material — /.ssh entries, /.npmrc, /.gitconfig — and iterates a curated list of credentia...

Timing Attack

com.ongres.scram:scram-common is vulnerable to Timing Attack. The vulnerability is due to the use of Arrays.equals for comparing sensitive authentication values, which performs short-circuit evaluations and causes variable execution times, allowing an attacker to exploit timing differences to inf...

SimpleSAMLphp allows timing side-channel attacks

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...

CVE-2020-28924

An issue was discovered in Rclone before 1.53.3. Due to the use of a weak random number generator, the password generator has been producing weak passwords with much less entropy than advertised. The suggested passwords depend deterministically on the time the second rclone was started. This limi...

CVE-2019-10213

OpenShift Container Platform (versions 4.1–4.2) is affected by CVE-2019-10213: secret data written to pod logs is not sanitized when an operator runs at Debug level or higher, enabling a low-privilege user to read sensitive material from logs. Root cause: unsanitized secrets in logs. Impact: info...

Information Disclosure

github.com/openshift/library-go is vulnerable to information disclosure. Unsanitized secret data is written to the static pod logs when the log level in a given operator is set to Debug or higher. A low privileged user could read pod logs to discover secret material if the log level has already...

CVE-2017-12872

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...

CVE-2017-12872

The 1 Htpasswd authentication source in the authcrypt module and 2 SimpleSAMLSession class in SimpleSAMLphp 1.14.11 and earlier allow remote attackers to conduct timing side-channel attacks by leveraging use of the standard comparison operator to compare secret material against user input...