Security update for python-oslo.utils

This update for python-oslo.utils fixes the following issues: CVE-2022-0718: Fixed incorrect password masking in debug output. bsc1196454 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can r...

MAL-2025-6067 Malicious code in @toptal/picasso-utils (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in @nytt/sass-utils (npm)

The package communicates with a domain associated with malicious activity...

Thinkgem JeeSite 代码注入漏洞

Thinkgem JeeSite is an open source Java EE enterprise-class rapid development platform for China Zhuo Yuan Thinkgem company . The platform includes system permissions components , data permissions components , data dictionary components , core tools components , view manipulation components ,...

MAL-2025-5977 Malicious code in worldapp-fe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fad2c4c3d30ab00bfd237b6e51443fe6108d11439361d023876477d325a5e8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in worldapp-fe-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fad2c4c3d30ab00bfd237b6e51443fe6108d11439361d023876477d325a5e8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

@altipla/directus-sdk-utils (=0.7.2), @bicou/directus-extension-imagga (>=1.6.3 <=1.6.6) +9 more potentially affected by CVE-2025-53889 via directus (>=10.10.0 <=11.8.0)

directus NPM version =10.10.0, =1.6.3, =11.16.1-depup.0, =15.0.0, =1.2.2, =1.0.0, =2.0.0 - directus-extension-blog-year-filter =1.0.0 - lease-directus-template =0.0.0 Source cves: CVE-2025-53889 Source advisory: OSV:GHSA-7CVF-PXGP-42FC...

MAL-2025-5958 Malicious code in string-parser-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 748b70284192ad043f664c6c220fd7416d86a39d02bee5c30e6181172b814688 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in string-parser-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 748b70284192ad043f664c6c220fd7416d86a39d02bee5c30e6181172b814688 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5962 Malicious code in themeone-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17ebc64d4990db35ad6d321dbbff948ef76f999ca0a2e279f26644a32f0abdc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5957 Malicious code in square-crypto-utils-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c2a693727e119b7e668536dcb77730f98ba80f9bcc2b03f5bbc80f53fea74d2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like...

Malicious code in win-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99d55e34bfdccef418c3d9a32fed525e724c57d61a1128d9924506b8b25200e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5753 Malicious code in win-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99d55e34bfdccef418c3d9a32fed525e724c57d61a1128d9924506b8b25200e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-PHHR-52QP-3MJ4 Transformers's Improper Input Validation vulnerability can be exploited through username injection

Hugging Face Transformers versions up to 4.49.0 are affected by an improper input validation vulnerability in the imageutils.py file. The vulnerability arises from insecure URL validation using the startswith method, which can be bypassed through URL username injection. This allows attackers to...

Hugging Face Transformers 安全漏洞

Hugging Face Transformers is Hugging Face's open source advanced natural language processing for Jax, PyTorch and TensorFlow. A security vulnerability exists in Hugging Face Transformers version 4.49.0, which stems from insufficient regular expression complexity in the getimports function in...

Jank 安全漏洞

Jank is a lightweight blogging system by the individual developer Fender. Jank has a security vulnerability that stems from the use of hard-coded passwords for the parameters accessSecret/refreshSecret in the file internal/utils/jwtutils.go...

MAL-2025-5626 Malicious code in internal-utils (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0d00b355d25f3b655de9e0b371123c75c0761a20b1bb05f7d45dcf595586070 The OpenSSF Package Analysis project identified 'internal-utils' @...

MAL-2025-6586 Malicious code in sinontop-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e4796f9772fd88b2cad42713f8d9b731428bea0bc0aaef2645676789636b7c1 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...

Malicious code in sinontop-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2e4796f9772fd88b2cad42713f8d9b731428bea0bc0aaef2645676789636b7c1 Series of packages mostly with an obfuscated infostealer attempting to collect Chrome data. While discord webhook is usually set to an example, there are other...