MAL-2025-80 Malicious code in controller-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 34e748f33e1982598d357d378cb8b42a4361f9a056afdd2c66b16586e034fe41 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2020-27748 affecting package xdg-utils 1.1.3-7

CVE-2020-27748 affecting package xdg-utils 1.1.3-7. No patch is available currently...

CVE-2022-4055 affecting package xdg-utils 1.1.3-7

CVE-2022-4055 affecting package xdg-utils 1.1.3-7. No patch is available currently...

AZL-55754 CVE-2024-55916 affecting package kernel for versions less than 5.15.176.3-1

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet If the KVP or VSS daemon starts before the VMBus channel's ringbuffer is fully initialized, we can hit the panic below: hvutils: Registering HyperV Utility Drive...

UBUNTU-CVE-2024-55916

In the Linux kernel, the following vulnerability has been resolved: Drivers: hv: util: Avoid accessing a ringbuffer not initialized yet If the KVP or VSS daemon starts before the VMBus channel's ringbuffer is fully initialized, we can hit the panic below: hvutils: Registering HyperV Utility Drive...

OSV-2025-7 Heap-buffer-overflow in oatpp::json::Utils::escapeUtf8Char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=387626404 Crash type: Heap-buffer-overflow WRITE 1 Crash state: oatpp::json::Utils::escapeUtf8Char oatpp::json::Utils::escapeString oatpp::json::Serializer::serializeString...

PT-2025-5666 · Oatpp · Oatpp

Name of the Vulnerable Software and Affected Versions: oatpp affected versions not specified Description: The issue is related to a heap-buffer-overflow error. Technical details about the error include the escapeUtf8Char and escapeString functions within oatpp::json::Utils, and the serializeStrin...

PT-2025-11592

Name of the Vulnerable Software and Affected Versions cifs-utils affected versions not specified Description The issue concerns cifs-utils, specifically the cifs.upcall component, which makes an upcall to the wrong namespace in containerized environments. Recommendations At the moment, there is n...

CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

CVE-2024-56433

CVE-2024-56433 affects shadow-utils (shadow) 4.4–4.17.0, which uses a default /etc/subuid range (e.g., UID 100000–165535) that can clash with locally defined UIDs. The documented impact is potential account takeover via newuidmap access to local or same-host resources (e.g., NFS home directories)...

CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

CVE-2024-56433

shadow-utils aka shadow 4.4 through 4.17.0 establishes a default /etc/subuid behavior e.g., uid 100000 through 165535 for the first user account that can realistically conflict with the uids of users defined on locally administered networks, potentially leading to account takeover, e.g., by...

@volpe/astro-utils (>=0.0.1 <=0.0.20), astro-npm-loader (>=0.0.1 <=0.1.2) potentially affected by CVE-2024-56159 via astro (=5.0.0-beta.5)

astro NPM version =5.0.0-beta.5 is affected by a known vulnerability. The following packages have a transitive dependency on astro and may be impacted: - @volpe/astro-utils =0.0.1, =0.0.1, =0.1.2 Source cves: CVE-2024-56159 Source advisory: OSV:GHSA-49W6-73CW-CHJR...

MAL-2024-11982 Malicious code in gft-model-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b553d507e20e5d98f5bb1934bad6b5d49d32085028d96603c5eceb371c3851e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in gft-model-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9b553d507e20e5d98f5bb1934bad6b5d49d32085028d96603c5eceb371c3851e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12053 Malicious code in uflexreward-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7379f8591040c92a4329b5312d80e8291304a7106cac2b41cb406b21a9e6b4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uflexreward-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f7379f8591040c92a4329b5312d80e8291304a7106cac2b41cb406b21a9e6b4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...