Malicious code in conn-utils (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 25be0eaa51dd4c4ba03afd81b4cfad938ceb07dacb0195a9179b46413178e086 Already during the installation, the file with slightly obfuscated code is loaded and starts exfiltrating information about the host. It especially targets...

@capriza/far (>=0.1.2 <=2.4.2), @cobalt-engine/cobower (=2.0.0) +388 more potentially affected by CVE-2024-12905 via tar-fs (>=0.1.8 <=1.16.3)

tar-fs NPM version =0.1.8, =0.1.2, =6.0.3, =6.0.3, =6.0.3, =2.1.1, =0.10.2, =0.0.0-beta.1, =0.0.0-beta.1, =0.0.0-beta.1, =0.1.0, =0.1.0, =1.0.5, =1.1.2 - @elm-node/npm-scripts =1.0.0 - @hlsrules-test/fc-libreoffice =1.0.0 and more Source cves: CVE-2024-12905 Source advisory: OSV:GHSA-PQ67-2WWV-3X...

CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

AZL-59273 CVE-2025-2312 affecting package cifs-utils for versions less than 6.14-3

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

DEBIAN-CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

AZL-59284 CVE-2025-2312 affecting package cifs-utils for versions less than 7.3-1

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312

CVE-2025-2312 affects cifs-utils (cifs.upcall) where, in containerized environments, an upcall is made to the wrong namespace, risking disclosure of the host Kerberos credentials cache. Public advisories across multiple distributions (Debian, Mageia, Alpine Linux, CBL-Mariner) confirm the flaw an...

CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312 cifs.upcall makes an upcall to the wrong namespace in containerized environments

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312 cifs.upcall makes an upcall to the wrong namespace in containerized environments

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312 cifs.upcall makes an upcall to the wrong namespace in containerized environments

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

CVE-2025-2312

A flaw was found in cifs-utils. When trying to obtain Kerberos credentials, the cifs.upcall program from the cifs-utils package makes an upcall to the wrong namespace in containerized environments. This issue may lead to disclosing sensitive data from the host's Kerberos credentials cache...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the concatenateForRewrite method in JettyUtils when the management proxy is enabled - which it is in the default configuration. An attacker can manipulate the URL to redirect requests to an arbitrary...

askap-flint (>=0.6.1 <=0.8.0), infrahub-server (>=1.1.0 <=1.1.10) +2 more potentially affected by CVE-2024-8183 via prefect (>=3.0.0rc20 <=3.0.11)

prefect PYPI version =3.0.0rc20, =0.6.1, =1.1.0, =1.1.0, =0.0.2, =0.0.10 Source cves: CVE-2024-8183 Source advisory: OSV:GHSA-4V9F-R55G-G6HC...

aporacle (>=0.0.126 <=0.0.143), assemblit (>=0.1.11 <=0.1.13) +17 more potentially affected by CVE-2024-8183 via prefect (>=2.0.0b16 <=2.19.4)

prefect PYPI version =2.0.0b16, =0.0.126, =0.1.11, =5.2.3, =2.37.0, =0.2.0, =0.4.0, =0.1.0, =0.0.1, =0.3.2, =0.0.217, =0.1.1, =0.15.3, =0.6.5, =0.6.8 - orchestration-utils =0.0.1 - prefect-duckdb =0.1.0a1 and more Source cves: CVE-2024-8183 Source advisory: SNYK:PYTHON-PREFECT-9487016...

askap-flint (>=0.6.1 <=0.8.0), infrahub-server (>=1.1.0 <=1.1.10) +2 more potentially affected by CVE-2024-8183 via prefect (>=3.0.0rc20 <=3.0.11)

prefect PYPI version =3.0.0rc20, =0.6.1, =1.1.0, =1.1.0, =0.0.2, =0.0.10 Source cves: CVE-2024-8183 Source advisory: SNYK:PYTHON-PREFECT-9487016...

Malicious code in cmft-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7480b4348d595d2f3e0c25957e99041d6301f7e51593c0334345c1cdfe2a080c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in migu-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccbd8955e0708787cb831d8758b4c240d432a13fe1c1c182ded5e19b8cd49d3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2575 Malicious code in migu-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ccbd8955e0708787cb831d8758b4c240d432a13fe1c1c182ded5e19b8cd49d3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...