CVE-2024-3094

CVE-2024-3094 CVE-2024-3094 is a critical security vulnerability discovered in the upstream tarballs of the xz utility, starting with version 5.6.0. This vulnerability involves malicious code that, through complex obfuscations, manipulates the build process of liblzma. What is this repo for? This...

Linux---Security---Detect-and-Mitigate-CVE-2024-3094

Linux- Security- Detect and Mitigate CVE-2024-3094 It was determined that malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. It was determined that only certain operating systems and operating system versions were affected by this vulnerability. This repo...

pulledpork

PulledPork PulledPork for Snort and Suricata rule management from Google code Find us on Libera.Chat IRC pulledpork Copyright C 2009-2021 JJ Cummings, Michael Shirk and the PulledPork Team! Thank you for choosing to use PulledPork! This file provides some basic guidance on the usage of PulledPork...

RLSA-2026:99593 Moderate: rpm security update

The RPM Package Manager RPM is a command-line driven package management system capable of installing, uninstalling, verifying, querying, and updating software packages. Security Fixes: rpm: Command Injection in rpmbuild -t getTarSpec via Unescaped Tarball Path CVE-2026-84837 rpm: rpmbuild...

Malicious code in internallib_v647 (npm)

Source: amazon-inspector 701b4c0d503cece80b2a7c5e7e59d1ae5b134b3b801e3ba966f177703917d244 package.json declares the dependency internallib-helper as a plain-HTTP tarball URL at a bare internal IP: http://10.0.77.5:8000/internallib-helper-1.0.0.tgz. On npm install, npm fetches and installs whateve...

CVE-2023-37478_npm_vs_pnpm

pnpm vs npm exploit This repo showcases how a difference in npm and pnpminstallation from tarballs can be exploited. The exploit is recorded in CVE-2023-37478. The javascript package constructed here claims it prints out a nice message to the user. When installed with npm, this is true. However,...

MAL-2026-19229 Malicious code in internallib_v647 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 701b4c0d503cece80b2a7c5e7e59d1ae5b134b3b801e3ba966f177703917d244 package.json declares the dependency internallib-helper as a plain-HTTP tarball URL at a bare internal IP:...

CS50FinalProject

CS50 Intro to Cybersecurity – Final Project Case Study: XZ Utils Backdoor CVE-2024-3094 This repository supports my 7-10 minute presentation on the XZ Utils backdoor, including a recap of the backdoor, the mechanism for the backdoor via release tarballs, and relevant supply-chain mitigations...

Malicious code in @rfewqa-fes/mnm-doc-mcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0495a09022e152fe8c13b9251497c56e333b58af6e54c412bfd43ff4503be1a7 package.json declares the sole dependency 'node-health-utils' as an off-registry HTTP tarball URL at a bare IP address...

Amazon Linux 2 : compat-rpm-411 (ALASMOCK2-2026-004)

The version of compat-rpm-411 installed on the remote host is prior to 4.11.3-40. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2MOCK2-2026-004 advisory. A flaw was found in rpmbuild. When rpmbuild processes a crafted tarball in tarball mode, a specially designed...

EulerOS 2.0 SP12 : rpm (EulerOS-SA-2026-4451)

According to the versions of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.c...

EulerOS 2.0 SP12 : rpm (EulerOS-SA-2026-4528)

According to the versions of the rpm packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.c...

Malicious code in hs-framework (npm)

Source: amazon-inspector 2950f0dff0145db43d5dd123c45c2786c7d42f58e7dec69e0178ca2aa325c478 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz instead of a registry version range. On npm install, npm fetche...

Malicious code in hs-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2950f0dff0145db43d5dd123c45c2786c7d42f58e7dec69e0178ca2aa325c478 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://storage.googleapis.com/lscunpentest/packuxfoundry.tgz inste...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: rpm (UTSA-2026-146970)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146970 advisory. A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in tools/rpmbuild.cc passes an...

Exploit for CVE-2026-114148

CVE-2026-114148 - .NET Linux Tarball Local Privilege Escalatio...

CentOS Linux 7 [TuxCare] Security Update: rpm / rpm-apidocs / rpm-build / rpm-build-libs / rpm-cron / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1792689093)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1792689093 advisory. - A vulnerability was found in RPM's rpmbuild tarball processing. When processing a crafted source archive, the getTarSpec function in...

Malicious code in @generic-means/ing-feat-scanner-libs (npm)

Source: amazon-inspector 7053eaf141232704108519a3b3e7a0f1197d9eaabfa9fd3f4ff56ae9f753d763 package.json declares its sole dependency ltidisafe as a bare HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.3.tgz rather than a registry version range or a git ref pinned to ...

Malicious code in @futurae-public/adaptive-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18526e44113025f1e08a31eb237515c63ae912a6cfe82bec37c14895f4f23178 package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.2.tgz...

.NET 9.0 Update - October 25, 2026

.NET 9.0 Update - October 25, 2026 .NET 9.0 has been refreshed with an out-of-band security update as of October 25, 2026. This update is separate from the regular monthly servicing release. See the release notes for details about updated packages. Important: This out-of-band security update...