Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system or virtual learning environment. A security vulnerability exists in Moodle that stems from a filter that is not adequately cleaned, resulting in arbitrary fil...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from tags not being properly hidden, where a user may find tags that...

Moodle 安全漏洞

Moodle is a free e-learning software platform open-sourced by Moodle, also known as a course management system, learning management system, or virtual learning environment. A security vulnerability exists in Moodle that stems from trusttext not being properly applied to recovered glossary entries...

MAL-2025-2236 Malicious code in @supera/share (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c348a3e52ca7aa30cd6b9bd7234d6385f1305e8c0f04c400ff236df303f06628 Any computer that has this package install...

$1.4 Billion Stolen From ByBit in Biggest Crypto Theft Ever

Plus: Apple turns off end-to-end encrypted iCloud backups in the UK after pressure to install a backdoor, and two spyware apps expose victim data—and the identities of people who installed the apps...

CVE-2025-25876

A vulnerability was found in ITSourcecode Simple ChatBox up to 1.0. This vulnerability affects unknown code of the file /delete.php. The attack can use SQL injection to obtain sensitive data...

solid 安全漏洞

solid is a declarative, efficient and flexible JavaScript library for building user interfaces open-sourced by SolidJS. A security vulnerability exists in solid that stems from a JSX fragment that does not properly escape user input, which could lead to a cross-site scripting attack...

DeepSeek found to be sharing user data with TikTok parent company ByteDance

A couple of weeks ago we reported on the concerns surrounding data collection and security at DeepSeek, the Chinese AI company which recently made headlines for shaking up the industry after seemingly appearing from nowhere to become top of the app download charts. Now South Korea’s Personal...

CVE-2025-1007

CVE-2025-1007 affects OpenVSX, specifically versions v0.9.0 through v0.20.0. The vulnerability arises in the /user/namespace/{namespace}/details API (and the related /user/namespace/{namespace}/details/logo) where a non-owner/non-contributor user can edit all namespace details (name, description,...

MAL-2025-1484 Malicious code in gurubu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4e2206593db7db1c14c4f78386bcef91c603218c4c26feda8f080978f342cbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1497 Malicious code in schedulermpastakash (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8011bc16764621a0c246e8c0ed40e150a3645ebe14b315d9a61c96f014a3653 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1476 Malicious code in @idps/contrib-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b812aaf7e12bd61301969890faac8bcd578104dec35d8c53abfd520ab05c4c8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Barebox 安全漏洞

Barebox is a versatile and flexible bootloader from the Barebox open source. A security vulnerability exists in Barebox versions prior to 2025.01.0, which stems from an integer overflow in dlmalloc.c. The vulnerability is caused by an integer overflow in the dlmalloc.c file...

ChurchCRM 安全漏洞

ChurchCRM is an open source CRM system built for churches by ChurchCRM Open Source. A security vulnerability exists in ChurchCRM version 5.13.0 that stems from vulnerability to a reflective cross-site scripting attack that allows session credentials to be stolen...

Hitachi Vantara Pentaho Data Integration & Analytics 安全漏洞

Hitachi Vantara Pentaho Data Integration & Analytics is a data integration and analytics system from Hitachi, Ltd Hitachi, Japan. A security vulnerability exists in Hitachi Vantara Pentaho Data Integration & Analytics that stems from an unrestricted JNDI identifier, which can lead to the disclosu...

Authelia 安全漏洞

Authelia is an open source single sign-on multi-factor portal for web applications by Authelia. A security vulnerability exists in Authelia versions prior to 4.38.19, which stems from a flaw in the login restriction mechanism, leading to an increased risk of brute force break-in...

Barebox 安全漏洞

Barebox is a versatile and flexible bootloader from the Barebox open source. A security vulnerability exists in Barebox versions prior to 2025.01.0, which stems from an integer overflow in ext4fsreadsymlink that results in a memory overwrite...

CVE-2024-13609

The 1 Click WordPress Migration Plugin – 100% FREE for a limited time plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.2 via the class-ocm-backup.php. This makes it possible for unauthenticated attackers to extract sensitive data includi...

Cordaware bestinformed 安全漏洞

Cordaware bestinformed is a mass notification system from Cordaware, Germany. A security vulnerability exists in Cordaware bestinformed that stems from improper input cleanup and vulnerability to stored cross-site scripting attacks...

Malicious code in coinstore-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3246c34dc7546f998ef55a78bdc8d5cacd2b0ff40a89fa184dc0cc614cb2f4a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...