Advisory ROSA-SA-2025-2729

Software: opensc 0.20.0 OS: ROSA Virtualization 3.0 packageevrstring: opensc-0.20.0-8.rv30 CVE-ID: CVE-2023-2977 BDU-ID: None CVE-Crit: HIGH CVE-DESC.: A vulnerability in OpenSC causes a buffer overflow in the pkcs15 cardoshaveverifyrcpackage function, allowing an attacker to cause a processing...

Malicious code in react-component-usage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 02edaef58fe9d6ea792eb3739c512482637fea90b44a07700f89233420a331f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-26264

GeoVision GV-ASWeb with the version 6.1.2.0 or less fixed in 6.2.0, contains a Remote Code Execution RCE vulnerability within its Notification Settings feature. An authenticated attacker with "System Settings" privileges in ASWeb can exploit this flaw to execute arbitrary commands on the server,...

Malicious code in eslint-plugin-externalincludes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09b1ebe297181abc6e2efc2e9452146ffd0b49dd6f09b94bb3ebb1481ff9b9a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mep-who (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fed998f266588bd60b1cba39d78eaa2ef59bee5fbe16f7ea4f8f04997798f2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in paypal-checkout-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8978fb3635d1339256e1aa90eab3f76ba33bad36f9a2ffd70d1f6fc7d60ccca8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pp-react-content-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8280f253e75704177d57797625fe0d81836b0ae85c09ebbc58cdbec1b2a5b4c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1610 Malicious code in mep-who (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2fed998f266588bd60b1cba39d78eaa2ef59bee5fbe16f7ea4f8f04997798f2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1589 Malicious code in fetch-tickers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0187567d205aa7da957efef8fc0b7abd060a5e4496f0028b5be6748eba2b74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fetch-tickers (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f0187567d205aa7da957efef8fc0b7abd060a5e4496f0028b5be6748eba2b74 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1602 Malicious code in jazz_services-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a10ab75b61db729e2ded7abcf4d5af6329e91554ab796f26e081becc4cfa851 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ssr-data-router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c6353bffc74b93b29b361e25a27b4a814f6e863985adaad92a91572071fba6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1608 Malicious code in material-start (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dc52f979cd49a98ecface27ce64a898eb95dad649bd6d9ffac7c11ce434a9697 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in golanci-lint-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e69962c9a060f9d61253d944cc7c3573debc57053555bb4dd496618bc1b6510f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ideal-paypal-payment-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a0c63436afa43460fe75374c026568d5b5f17a29326ac24517be8a2b1dcd113 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in auth0-nodejs-webapp-sample-new-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66ab3d3775ff156aa2978e726606e002c0b7d2673ea1667898733604c8521491 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1615 Malicious code in multipage-checkout (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13f2d0c3e5db704d6bce0de0eb2729951e279aa28be75eafa0df32e85a38e3c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1642 Malicious code in vinothzomato-foremandns (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91da1ea036e46f838dc1a3363e8472c6361e1a08bda6aa73fb22831159fbd379 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1598 Malicious code in ideal-paypal-payment-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a0c63436afa43460fe75374c026568d5b5f17a29326ac24517be8a2b1dcd113 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1620 Malicious code in petstore-typescript-node-sample (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df75428cea0bd4c85e2a5e3442fb967d4ec954a570cceb9f0d888e53b6cafd91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...