5946 matches found
MAL-2025-47019 Malicious code in jsexports-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3faa85960d0da372c3591bd8e6336208f04090cc24ca88b734d8e84d5f389c16 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Linux Distros Unpatched Vulnerability : CVE-2025-6224
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Certificate generation in juju/utils using the cert.NewLeaf function could include private information. If this certificate were then transferred over the netwo...
Linux Distros Unpatched Vulnerability : CVE-2022-24279
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package madlib-object-utils before 0.1.8 are vulnerable to Prototype Pollution via the setValue method, as it allows an attacker to merge object prototypes...
CodeceptJS's incomprehensive sanitation can lead to Command Injection
CodeceptJS versions 3.5.0 through 3.7.5-beta.18 contain a command injection vulnerability in the emptyFolder function lib/utils.js. The execSync command directly concatenates the user-controlled directoryPath parameter without sanitization or escaping, allowing attackers to execute arbitrary...
Malicious Package
Overview classbreeze-utils is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...
Malicious Package
Overview twcompose-utils is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...
MAL-2025-46148 Malicious code in string-modifier-utils (npm)
The package string-modifier-utils was found to contain malicious code. --- -= Per source details. Do not edit below this line.=-...
CVE-2025-58361
Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, but the check only strips "javascript:"...
CVE-2025-26439
In getComponentName of AccessibilitySettingsUtils.java, there is a possible way to for a malicious Talkback service to be enabled instead of the system component due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...
CVE-2025-58361: Improper Input Validation
Promptcraft Forge Studio is a toolkit for evaluating, optimizing, and maintaining LLM-powered applications. All versions contain an non-exhaustive URL scheme check that does not protect against XSS. User-controlled URLs pass through src/utils/validation.ts, but the check only strips javascript: a...
Use of Incorrectly-Resolved Name or Reference
Overview hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the getPath function in the utils/url.ts file. An attacker can gain unauthorized access to protected endpoints by sending specially craft...
Use of Incorrectly-Resolved Name or Reference
Overview org.webjars.npm:hono is an Ultrafast web framework for the Edges Affected versions of this package are vulnerable to Use of Incorrectly-Resolved Name or Reference via the getPath function in the utils/url.ts file. An attacker can gain unauthorized access to protected endpoints by sending...
MAL-2025-47755 Malicious code in data-processing-utils (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 f5c7542831f6f9fe72a65e436b1f85c10261aac12ceae6f1bcc490afad6d1aaa Installing packages exfiltrates data different in different packages and versions or run revshells --- Category: MALICIOUS - The campaign has clearly malicious...
CVE-2025-9796 thinkgem JeeSite EncodeUtils.java decodeUrl2 cross site scripting
A vulnerability was found in thinkgem JeeSite up to 5.12.1. This affects the function decodeUrl2 of the file common/src/main/java/com/jeesite/common/codec/EncodeUtils.java. The manipulation results in cross site scripting. It is possible to launch the attack remotely. The exploit has been made...
MAL-2025-45766 Malicious code in react-native-wm-utils (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 790e08de4e57c51f573e613b7cdd780343c4f14a00aadaff30e05fca9cb69f8b Any computer that has this package installed or running should be considered...
Malicious code in react-native-wm-utils (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 790e08de4e57c51f573e613b7cdd780343c4f14a00aadaff30e05fca9cb69f8b Any computer that has this package installed or running should be considered...
Malicious code in internal-helper-utils (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...
Thinkgem JeeSite 安全漏洞
Thinkgem JeeSite is an open source Java EE enterprise-class rapid development platform of China Zhuo Yuan Thinkgem company . The platform includes system permissions components , data permissions components , data dictionary components , core tools components , view manipulation components ,...
Linux Distros Unpatched Vulnerability : CVE-2025-52968
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xdg-open in xdg-utils through 1.2.1 can send requests containing SameSite=Strict cookies, which can facilitate CSRF. For example, xdg-open could be modified to,...