OESA-2026-3862 rpm security update

The RPM Package Manager RPM is a powerful package management system capability as below Security Fixes: A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed tar member name can lead to macro injection. This vulnerability allows a remote...

trivy-action

Trivy Action GitHub Action para Trivy !GitHub Releaserelease-imgrelease !GitHub Marketplacemarketplace-imgmarketplace !Licenselicense-imglicense Tabla de contenido Uso Escanear Pipeline de CI Escanear Pipeline de CI con Configuración de Trivy Caché Configuración de Trivy Escanear un Tarball Usar...

pulledpork

PulledPork PulledPork for Snort and Suricata rule management from Google code Find us on Libera.Chat IRC pulledpork Copyright C 2009-2021 JJ Cummings, Michael Shirk and the PulledPork Team! Thank you for choosing to use PulledPork! This file provides some basic guidance on the usage of PulledPork...

CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 es una vulnerabilidad de seguridad crítica descubierta en los tarballs oficiales de la utilidad xz, a partir de la versión 5.6.0. Esta vulnerabilidad implica código malicioso que, a través de complejas ofuscaciones, manipula el proceso de compilación de liblzma. ¿Para...

CS50FinalProject

CS50 Intro to Cybersecurity – Proyecto Final Caso de estudio: Puerta trasera de XZ Utils CVE-2024-3094 Este repositorio respalda mi presentación de 7 a 10 minutos sobre la puerta trasera de XZ Utils, incluyendo un resumen de la puerta trasera, el mecanismo de la misma mediante los tarballs de...

CVE-2023-37478_npm_vs_pnpm

Exploit de pnpm vs npm Este repositorio muestra cómo se puede explotar una diferencia entre npm y pnpm en la instalación desde tarballs. El exploit está registrado en CVE-2023-37478. El paquete de JavaScript construido aquí afirma que imprime un mensaje agradable al usuario. Cuando se instala con...

Linux---Security---Detect-and-Mitigate-CVE-2024-3094

Linux - Seguridad - Detectar y Mitigar CVE-2024-3094 Se determinó que se descubrió código malicioso en los tarballs upstream de xz, a partir de la versión 5.6.0. Se determinó que solo ciertos sistemas operativos y versiones de sistemas operativos se vieron afectados por esta vulnerabilidad. Este...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837

A command injection vulnerability was identified in rpm , specifically in the gettarspec function used by rpmbuild -t*. The root cause is an unescaped tarball path or filename that, when containing shell metacharacters, allows an attacker to inject arbitrary commands. This is particularly relevan...

CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837 Rpm: command injection in `rpmbuild -t*` (`gettarspec`) via unescaped tarball path

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

CVE-2026-84837

A flaw was found in rpm. An attacker can exploit a command injection vulnerability by influencing the path or filename of a tarball processed by rpmbuild -t to include shell metacharacters. This is particularly relevant in automated build or continuous integration CI workflows that ingest...

pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

Summary When resolving a package, pnpm uses the resolved manifest name as a raw path segment for the isolated-linker import target. A tarball dependency whose package.json name is a scoped path traversal @x/../../…/ is therefore extracted outside nodemodules, to an attacker-chosen absolute path,...

CVE-2026-82393

A flaw was found in pnpm. This vulnerability allows a remote attacker to perform a path traversal by crafting a malicious tarball dependency's manifest name. During package installation, pnpm fails to properly validate the manifest name, leading to files being extracted outside the intended...

CVE-2026-82393 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...

CVE-2026-82393 pnpm: A tarball dependency's manifest `name` escapes node_modules → arbitrary file write/overwrite on install

pnpm is a package manager. Prior to 10.34.5 and 11.11.0, pnpm accepts a scoped path traversal in a tarball dependency's package.json manifest name because pnpm11/resolving/npm-resolver/src/pickPackage.ts rejects slash characters only for unscoped names. During pnpm install, the unvalidated name...

CVE-2026-82393

pnpm prior to 10.34.5 and 11.11.0 is vulnerable to a scoped path traversal in a tarball dependency's package.json manifest name. The root cause is in pickPackage.ts (npm-resolver), which rejects slash characters only for unscoped names, allowing a crafted scoped name to reach raw path joins in re...

MAL-2026-15524 Malicious code in tabbables (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb package.json at line 11 declares a dependency whose key equals the package's own name tabbables and whose value is the raw HTTPS URL...

SUSE CVE-2026-32637

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...

CVE-2026-32637

Velero is an open source tool for backing up, restoring, and migrating Kubernetes cluster resources and persistent volumes. Prior to 1.18.1, an attacker who compromises the backup object-storage backend can upload a malicious backup tarball containing parent-directory paths that escape the...