Malicious code in @gmgn/app-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84805b96dd0a60155a6fa059a708837254facd211be9d7b614fae3a5fdeffa70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-7027

creationtimestamp| type| source ---|---|--- 2025-07-14 13:45:03+00:00| seen| https://t.me/truesecator/7227 2025-07-15 14:29:23+00:00| seen| https://t.me/SEReborn/5756 2025-07-16 17:11:08+00:00| seen| https://bsky.app/profile/fraustief.bsky.social/post/3lu3vx5gtfk2k 2025-07-16 17:11:11+00:00| seen...

Time Line 代码问题漏洞

Time Line is a timeline application from the Time Line Official individual developer. A code issue vulnerability exists in Time Line that stems from insufficient file upload validation, which could result in a malicious file upload or denial of service...

CVE-2025-7534

creationtimestamp| type| source ---|---|--- 2025-07-13 18:05:08+00:00| seen| https://bsky.app/profile/potato.software/post/3ltuhl46hjn2t...

CVE-2024-41169

creationtimestamp| type| source ---|---|--- 2025-07-13 09:20:51+00:00| seen| https://seclists.org/oss-sec/2025/q3/38 2025-07-13 11:46:22+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3lttsfslawu22...

androidapps

It is an Android application repository, likely containing a pro...

CVE-2025-31267

An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information...

CVE-2025-6851

creationtimestamp| type| source ---|---|--- 2025-07-12 21:02:24+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3ltsaz5u3cb2k 2025-07-15 16:32:15+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2025/CVE-2025-6851.yaml 2025-07-16...

CVE-2025-0141

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on enables a locally authenticated non administrative user to escalate their privileges to root on macOS and Linux or NT AUTHORITY\SYSTEM on Windows. The GlobalProtect app on iOS, Android, Chrome OS and...

CVE-2025-0140

An incorrect privilege assignment vulnerability in the Palo Alto Networks GlobalProtect™ App on macOS devices enables a locally authenticated non administrative user to disable the app even if the GlobalProtect app configuration would not normally permit them to do so. The GlobalProtect app on...

CVE-2025-53636 Open OnDemand Shell App closed websocket DoS

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service DoS to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6...

CVE-2025-53636

Open OnDemand (Open Source HPC portal) is affected by a DoS vulnerability where flooding logs via the shell app can generate very large log files. Affected versions are prior to 3.1.14 and prior to 4.0.6. The issue stems from improper log handling and results in DoS to the Open OnDemand system. F...

CVE-2025-53636 Open OnDemand Shell App closed websocket DoS

Open OnDemand is an open-source HPC portal. Users can flood logs by interacting with the shell app and generating many errors. Users who flood logs can create very large log files causing a Denial of Service DoS to the ondemand system. This vulnerability is fixed in 3.1.14 and 4.0.6...

Use of Hard-coded Password

Overview Affected versions of this package are vulnerable to Use of Hard-coded Password via the NewToken function. An attacker can gain unauthorized access to sensitive information by exploiting the use of a hard-coded password in the JSON Web Token handling process. Remediation There is no fixed...

Nextcloud: Deck app allowed user with "Can share" permission to modify permissions of other non-owners

The Deck app in Nextcloud allowed users with "Can share" permission to modify the permissions of other non-owners...

Marvell QConvergeConsole path traversal vulnerability (CNVD-2025-20445)

Marvell QConvergeConsole is a unified adapter management software across data centers from Marvell USA. A path traversal vulnerability exists in Marvell QConvergeConsole due to an error in the getAppFileBytes method. An attacker could exploit the vulnerability to disclose information in the SYSTE...

Marvell QConvergeConsole Path Traversal Vulnerability (CNVD-2025-20443)

Marvell QConvergeConsole is a unified adapter management software across data centers from Marvell USA. A path traversal vulnerability exists in Marvell QConvergeConsole due to an error in the deleteAppFile method. An attacker could exploit the vulnerability to delete a file in the SYSTEM context...

📄 The Language Sloth Web Application 1.0 Cross Site Scripting

The Language Sloth Web Application version 1.0 suffers from a cross site scripting vulnerability. CVE-2025-45778 CVE-2025-45778: Authenticated Stored XSS. An authenticated stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrar...

CVE-2025-31267

An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information...

CVE-2025-31267

An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information...