3336 matches found
CVE-2025-14104
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...
CVE-2025-14104 Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...
CVE-2025-14104 Util-linux: util-linux: heap buffer overread in setpwnam() when processing 256-byte usernames
A flaw was found in util-linux. This vulnerability allows a heap buffer overread when processing 256-byte usernames, specifically within the setpwnam function, affecting SUID Set User ID login-utils utilities writing to the password database...
CVE-2025-14104
CVE-2025-14104 concerns a heap buffer overread in util-linux's setpwnam() when processing 256-byte usernames, affecting SUID login-utils that write to the password database. The vulnerability is exploitable locally with low privileges and can impact availability (high) and confidentiality (low); ...
Arbitrary Code Injection
Overview @modern-js/utils is a progressive web framework based on React. Affected versions of this package are vulnerable to Arbitrary Code Injection via unsafe deserialization of RSC payloads from HTTP requests to Server Function endpoints. An unauthenticated attacker can execute arbitrary code ...
`uniswap-utils` was removed from crates.io for malicious code
It depended on the evm-units crate, which appeared to be attempting to steal cryptocurrency...
RUSTSEC-2025-0145 `uniswap-utils` was removed from crates.io for malicious code
It depended on the evm-units crate, which appeared to be attempting to steal cryptocurrency...
Oracle Linux 10 : ELSA-2025-20145-0: / shadow-utils (ELSA-2025-201450)
The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-201450 advisory. 2:4.15.0-8 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-93172 Tenable has extracted the preceding description block directly from...
shadow-utils security update
An update is available for shadow-utils. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The shadow-utils packages include programs for converting UNIX password...
RLSA-2025:20145 Low: shadow-utils security update
The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fixes: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 For...
RockyLinux 10 : shadow-utils (RLSA-2025:20145)
The remote RockyLinux 10 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2025:20145 advisory. shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 Tenable has extracted the preceding description...
EUVD-2025-199457
Malicious code in @oku-ui/utils npm...
Malicious code in @oku-ui/utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3e363f9563598ec9e11de3c2f70d1e8f832d7cf86e80fa1ee85b454d7745c662 The package @oku-ui/utils was found to contain malicious code. Source: google-open-source-security...
Oracle Linux 9 : ELSA-2025-20559-0: / shadow-utils (ELSA-2025-205590)
The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2025-205590 advisory. 2:4.9-15 - nss.c: shadowlogfd to stderr. Resolves: RHEL-83431 - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940...
AlmaLinux 10 : shadow-utils (ALSA-2025:20145)
The remote AlmaLinux 10 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2025:20145 advisory. shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 Tenable has extracted the preceding description blo...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...
@voiceflow/backend-utils (>=4.8.3 <=5.0.3) potentially affected by unknown CVE via @voiceflow/verror (=1.1.3)
@voiceflow/verror NPM version =1.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on @voiceflow/verror and may be impacted: - @voiceflow/backend-utils =4.8.3, =5.0.3 Source cves: unknown CVE Source advisory: SNYK:JS-VOICEFLOWVERROR-14103444...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...