CVE-2025-8855

Optimus Software Brokerage Automation before version 1.1.71 is affected by multiple auth-related issues: Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, and Authentication Bypass by Assumed-Immutable Data. These flaws enable exploitation ...

CVE-2025-8855 2FA Expiry Bypass in Optimus Software's Brokerage Automation

Authorization Bypass Through User-Controlled Key, Weak Password Recovery Mechanism for Forgotten Password, Authentication Bypass by Assumed-Immutable Data vulnerability in Optimus Software Brokerage Automation allows Exploiting Trust in Client, Authentication Bypass, Manipulate Registry...

Security Bulletin: Security vulnerability affect IBM Business Automation Workflow - CVE-2025-52999

Summary IBM Business Automation Workflow Case documentation in before 25.0.0 built upon a version of DITA, which packages a vulnerable copy of jackson-core. Vulnerability Details CVEID:CVE-2025-52999 DESCRIPTION: jackson-core contains core low-level incremental "streaming" parser and generator...

Rockwell Automation Studio 5000 Simulation Interface Code Execution Vulnerability

Rockwell Automation Studio 5000 Simulation Interface is a simulation modeling tool from Rockwell Automation. A code execution vulnerability exists in Rockwell Automation Studio 5000 Simulation Interface, which can be exploited by an attacker to cause scripts to be executed with administrator...

Rockwell Automation Arena 安全漏洞

Rockwell Automation Arena is a discrete-event simulation and automation software from Rockwell Automation USA. Rockwell Automation Arena suffers from a stack buffer overflow vulnerability that originates when the program fails to properly validate the length and size of input data, which could be...

Optimus Brokerage Automation 授权问题漏洞

Optimus Brokerage Automation is an automation management software from Optimus, Turkey. An authorization issue vulnerability exists in Optimus Brokerage Automation versions prior to 1.1.71 that stems from an authorization bypass and weak password recovery mechanism issue that could lead to...

Rockwell Automation FactoryTalk DataMosaix Private Cloud Cross-Site Scripting Vulnerability

Rockwell Automation FactoryTalk DataMosaix Private Cloud is an industrial data platform product from Rockwell Automation USA. Rockwell Automation FactoryTalk DataMosaix Private Cloud suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering an...

Unspecified Vulnerability in Rockwell Automation Verve Asset Manager

Rockwell Automation Verve Asset Manager is a vendor-neutral OT endpoint management platform from Rockwell Automation USA. A security vulnerability exists in Rockwell Automation Verve Asset Manager that can be exploited by an attacker to read, update, and delete users via the API...

*Rockwell Automation AADvance-Trusted SIS Workstation *

RISK EVALUATION Successful exploitation of this vulnerability may allow remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all control system devices...

Rockwell Automation FactoryTalk DataMosaix Private Cloud

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to take over accounts, steal credentials, redirect users to a malicious website, or bypass MFA. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of...

Rockwell Automation Verve Asset Manager

RISK EVALUATION Successful exploitation of this vulnerability could result in an attacker accessing or altering user data. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as: Minimize network exposure for all...

Malicious code in inquirer-winston-commitlint-cosmiconfig (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8d8803b934bddaa10af678e2f1095520a0c5df75893b63ef2fb45b3564318c6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in protected-thread-cron-integer-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a8a54f3515cbdff294501d3b30177d1f4b221d5540a7178e1efc0fbbdc57b0a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bootstrap-futurology-bootstrap-html-webpack-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b104189a74b27deed81a647b36a22f7fbca02dfd1483495bc1805ff2b673e36 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in materialize-prosthetics-petrology-resonance (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 01dd8da38192770203f00127f8b6eceeccf90a6ade8e100f008b2c78c4a8867e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in throw-simple-old-export-info (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7fa0e7015572a5c0c2140d2bd0a0d6d2e85a91da0626aa234799986419d1f56 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in notify-beta-tree-mock-minify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3cd7b1d54a109d886470b1eb138564f487c08a552cb82b12abedc42d0adfc3a5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188940 Malicious code in public-mechatronics-polaris-seismology (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 716464a4c535cdead2933258ca6f1d745693f5efced69bb34dec1ce417342f63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in proxy-process-rho-chi-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcbf9b30ea0fbcd0b34c3091843c49cea3a14ca9545d7b4ab2def8a21e698b4e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-188876 Malicious code in prompts-xanthus-blitz-eslint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5254336ae396f90fdca8d9a98e3c45ded6be01d1e812733bf65f8d8a93c58b39 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...