Malicious code in byaziine_validator (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f12a2c76230f3f02e4f5f0e1b7124c3fcdafddd9b28e6083e61b3c2a92f96eb Any computer that has this package installed or running should be considered...

EAP: wildfly-elytron has a SSRF security issue

A flaw was found in JwtValidator.resolvePublicKey in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery SSRF vulnerabili...

EAP: wildfly-elytron has a SSRF security issue

A flaw was found in JwtValidator.resolvePublicKey in JBoss EAP, where the validator checks jku and sends a HTTP request. During this process, no whitelisting or other filtering behavior is performed on the destination URL address, which may result in a server-side request forgery SSRF vulnerabili...

SoK: Current State of Ethereum'S Enshrined Proposer Builder Separation

Initially introduced to Ethereum via Flashbots' MEV-boost, Proposer-Builder Separation allows proposers to auction off blockspace to a market of transaction orderers, known as builders. PBS is currently available to validators through the aforementioned MEV-boost, but its unregulated and...

Malware in envs-validator

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in envs-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14d66a16720127b714fd0b4972d056bd66309e46b1cbf745656b742fe3bc33f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5193 Malicious code in envs-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14d66a16720127b714fd0b4972d056bd66309e46b1cbf745656b742fe3bc33f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2025-38005

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma: Add missing locking Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled: 4.128073 WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169...

CVE-2025-38005: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: dmaengine: ti: k3-udma: Add missing locking Recent kernels complain about a missing lock in k3-udma.c when the lock validator is enabled: 4.128073 WARNING: CPU: 0 PID: 746 at drivers/dma/ti/../virt-dma.h:169...

CVE-2024-56158

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. Thi...

CVE-2024-56158 XWiki allows SQL injection in query endpoint of REST API with Oracle

XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. Thi...

Hibernate Validator < 6.2 / 7.0 Arbitrary RCE

Hibernate Validator before 6.2.0 and 7.0.0, by default and depending how it is used, may interpolate user-supplied input in a constraint violation message with Expression Language. This could allow an attacker to access sensitive information or execute arbitrary Java code. Hibernate Validator as ...

XWiki Platform Injection Vulnerability

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. An SQL injection vulnerability exists in XWiki Platform that stems from the query validator not cleaning up functions such as DBMSXMLGEN or DBMSXMLQUERY, which could lead to an SQL injection...

Expired Pointer Dereference

Overview nokogiri is a gem for parsing HTML, XML, SAX, and Reader. Affected versions of this package are vulnerable to Expired Pointer Dereference via 'xmlSchematronGetNode function in Schematron validator. An attacker can cause a crash or execute arbitrary code by triggering use of freed memory...

Arbitrary Code Injection

org.hibernate.validator:hibernate-validator is vulnerable to Arbitrary Code Injection. The vulnerability is due to expression language injection due to interpolation of user-supplied input in constraint violation messages using Expression Language, which may allow attackers to access sensitive da...

Unraveling Ethereum'S Mempool: the Impact of Fee Fairness, Transaction Prioritization, and Consensus Efficiency

Ethereum's transaction pool mempool dynamics and fee market efficiency critically affect transaction inclusion, validator workload, and overall network performance. This research empirically analyzes gas price variations, mempool clearance rates, and block finalization times in Ethereum's...

com.github.jinahya:jsonrpc-bind-tests (0.7.1), org.amebastack.container:ameba-container-grizzly (>=0.1.6c, <=0.1.6e) +185 more potentially affected by CVE-2020-5245 +1 more via org.hibernate.validator:hibernate-validator (>=7.0.0.alpha1, <=7.0.0.alpha6)

org.hibernate.validator:hibernate-validator MAVEN version =7.0.0.alpha1, =0.1.6c, =0.1.2, =0.1.2, =0.1.2, =0.1.6c, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0-m2, =3.0.0 and more Source cves: CVE-2020-5245, CVE-2025-35036 Source advisory: GHSA-7V6M-28JR-RG84...

com.codingrodent.jackson.crypto:jackson-json-crypto (0.1.0), com.codingrodent:jackson-json-crypto (>=1.0.0, <=1.1.0) +91 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.3.0.final)

org.hibernate:hibernate-validator MAVEN version 5.3.0.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - com.codingrodent.jackson.crypto:jackson-json-crypto 0.1.0 -...

br.net.woodstock.rockframework:rockframework-domain (>=1.2.1, <=1.2.2), com.alexnederlof:jasperreports-plugin (1.7) +69 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (3.1.0.ga)

org.hibernate:hibernate-validator MAVEN version 3.1.0.ga is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - br.net.woodstock.rockframework:rockframework-domain =1.2.1, =1.5.0, =0.7.9, =1.3, =1.4 and...

br.com.ingenieux.cloudy:cloudy-data (0.0.5), ca.ibodrov.concord:testcontainers-concord (>=0.0.2, <=0.0.20) +178 more potentially affected by CVE-2025-35036 via org.hibernate:hibernate-validator (5.1.2.final)

org.hibernate:hibernate-validator MAVEN version 5.1.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.hibernate:hibernate-validator and may be impacted: - br.com.ingenieux.cloudy:cloudy-data 0.0.5 - ca.ibodrov.concord:testcontainers-concord...