MAL-2025-2651 Malicious code in blockzie-save-svg-as-png (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12218d7a2fc38f96f07e686aaf4c4e5a76506d1dd69cdb9a90ab2e1346e36e0c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VanHelsing RaaS Launch: 3 Victims, $5K Entry Fee, Multi-OS, and Double Extortion Tactics

A ransomware-as-a-service RaaS operation called VanHelsing has already claimed three victims since it launched on March 7, 2025, demanding ransoms as high as $500,000. "The RaaS model allows a wide range of participants, from experienced hackers to newcomers, to get involved with a $5,000 deposit...

SAP NetWeaver AS SQL Injection Vulnerability (CNVD-2025-07612)

SAP NetWeaver AS is a SAP web application server from SAP, Germany. SAP NetWeaver AS suffers from a SQL injection vulnerability that originates from a program that does not properly check for authorization, which could be exploited by an attacker to gain control over data in an Informix database,...

Regular Expression Denial of Service (ReDoS)

Overview org.webjars:jspdf is a WebJar for jspdf. Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the addImage, html, and addSvgAsImage methods. An attacker can occupy excessive CPU by supplying a malicious data-url. PoC js import jsPDF from "jpsd...

Analysis of Black Basta Ransomware Chat Leaks

Analysis of Black Basta Ransomware Chat Leaks By Jambul Tologonov and John Fokker · March 18, 2025 Introduction On Feb 11, 2025 a Telegram user @ExploitWhispers shared via their Telegram channel ‘shopotbasta’ EN: ‘basta whisper’ Black Basta RaaS Ransomware as a Service Matrix chat leaks containin...

AZL-58867 CVE-2024-40635 affecting package containerd2 for versions less than 2.0.0-8

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a UID:GID larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as roo...

CVE-2024-40635

containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers launched with a User set as a "UID:GID" larger than the maximum 32-bit signed integer can cause an overflow condition where the container ultimately runs as...

CVE-2025-28896

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects AS English Admin: from n/a through = 1.0.0...

PT-2025-11095

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software affected versions not specified Description: A vulnerability in the confederation implementation for the Border Gateway Protocol BGP in Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause a...

CVE-2025-28896

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects AS English Admin: from n/a through = 1.0.0...

CVE-2025-28896 WordPress AS English Admin plugin <= 1.0.0 - Open Redirection vulnerability

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects AS English Admin: from n/a through = 1.0.0...

CVE-2025-28896

CVE-2025-28896 describes an Open Redirect vulnerability in the WordPress plugin “AS English Admin” by Akshar Soft Solutions. Affected versions are listed as from n/a through 1.0.0. The root cause is a URL redirection issue that can funnel users to untrusted sites, enabling phishing-like redirects...

DCRat backdoor returns

Since the beginning of the year, we've been tracking in our telemetry a new wave of DCRat distribution, with paid access to the backdoor provided under the Malware-as-a-Service MaaS model. The cybercriminal group behind it also offers support for the malware and infrastructure setup for hosting t...

CVE-2025-28896: URL Redirection to Untrusted Site

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in Akshar Soft Solutions AS English Admin as-english-admin allows Phishing.This issue affects AS English Admin: from n/a through = 1.0.0...

PT-2025-10936

Name of the Vulnerable Software and Affected Versions: Akshar Soft Solutions AS English Admin versions 1.0.0 and earlier Description: The issue is related to a URL redirection vulnerability, also known as 'Open Redirect', which allows phishing attacks by redirecting users to untrusted sites. This...

CVE-2024-11087

The miniOrange Social Login and Register Discord, Google, Twitter, LinkedIn Pro Addon plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 200.3.9. This is due to insufficient verification on the user being returned by the social login token. This make...

OESA-2025-1258 firefox security update

Mozilla Firefox is a standalone web browser, designed for standards compliance and performance. Its functionality can be enhanced via a plethora of extensions. Security Fixes: On Windows 10, when using the 'Save As' functionality, an attacker could have tricked the browser into saving the file wi...

PT-2025-10049

Name of the Vulnerable Software and Affected Versions UiPress lite versions up to, and including, 3.5.04 Description The issue allows unauthorized modification of data, potentially leading to privilege escalation, due to a missing capability check on the uip save form as option function. This...

CVE-2025-27822: Incorrect Authorization

An issue was discovered in the Masquerade module before 1.x-1.0.1 for Backdrop CMS. It allows people to temporarily switch to another user account. The module provides a "Masquerade as admin" permission to restrict people who can masquerade from switching to an account with administrative...

PT-2025-10126

Name of the Vulnerable Software and Affected Versions Backdrop CMS Masquerade module versions prior to 1.x-1.0.1 Description An issue in the Masquerade module allows users to temporarily switch to another user account, potentially bypassing the "Masquerade as admin" permission. This permission is...