CVE-2025-12739

CVE-2025-12739 involves a Cross-Site Scripting (XSS) vulnerability in Looker’s Extension Loader. An attacker with viewer permissions can craft a malicious URL that, when opened by a Looker administrator, could run attacker-supplied script. Exploitation requires at least one Looker extension insta...

CVE-2025-12739 Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise

An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Exploitation required at least one Looker extension installed on the instance. Looker-hosted and Self-hosted were found to be vulnerable. This...

CVE-2025-12739 Cross-Site Scripting (XSS) in Looker's Extension Loader leading to Admin Account Compromise

An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-supplied script. Exploitation required at least one Looker extension installed on the instance. Looker-hosted and Self-hosted were found to be vulnerable. This...

MAL-2025-190803 Malicious code in @ensdomains/cypress-metamask (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19427e64315a085f7001dff6a896730aa4cce33cf679f6a2da0a8bc61e96fb58 The package @ensdomains/cypress-metamask was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190634 Malicious code in @validate-pubkey/hex (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 05db2afe6b0d7557f2c2153dd15df68ab69667e8402bf92f2b2e2d900eb5728f The package @validate-pubkey/hex was found to contain malicious code. Source: ghsa-malware...

Malicious code in parse-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e6800038c1b56247a0767faecf501d0c74de134197bb0edbae2d27b8a958547 The package parse-session was found to contain malicious code. Source: ghsa-malware 5b04d6ff25ce91de5057fed89547b08687055f2ca7a217a2886eecb79c06f9e9...

MAL-2025-190627 Malicious code in chai-async-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e99ef9605c8341ad648b4f6fb3d4102c0288cf3742d3e1abe55c1d45d9fcdbec The package chai-async-chain was found to contain malicious code. Source: ghsa-malware fdec53906ddd8f960924b6b45b6c8a742115debcec85495bd0f052d7d13105...

Malicious code in chai-async-chain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e99ef9605c8341ad648b4f6fb3d4102c0288cf3742d3e1abe55c1d45d9fcdbec The package chai-async-chain was found to contain malicious code. Source: ghsa-malware fdec53906ddd8f960924b6b45b6c8a742115debcec85495bd0f052d7d13105...

Malicious code in hash-guard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7b2ca55ce577caa1adabc53a3513e7b1d739be9cf9870f502d0dce75b44e2540 The package hash-guard was found to contain malicious code. Source: ghsa-malware 7c7e7dba950f2d191fe82c46ed3f9abd10509690b07fb3f1fb97f0ec39ff4304 Any...

Malicious code in loliloli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 49613dc24146ca83bc9bd4c3192468ff9b16fc61797e4b79a957d79f98d3552b The package loliloli was found to contain malicious code. Source: ghsa-malware 6188273fee11225ff9b29efe7923768ac1792c131fd40768f5127839c6be6ceb Any...

Malicious code in token-verify-passport (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c9e55c841368b86c3afd97dd35da3304c3507470af6aeb1bada98fa128233e03 The package token-verify-passport was found to contain malicious code. Source: ghsa-malware...

MAL-2025-190624 Malicious code in base62-58x (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 329e19a0dfe372f18c65552e38f92a7cdaeae2c3bcfae8956d0a233a7885da88 The package base62-58x was found to contain malicious code. Source: ghsa-malware 5cd641e4e74a586087038295a99f8a1ee51c4b8ee02dd79da6aec94e39c39999 Any...

MAL-2025-190625 Malicious code in lion-second-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0070c2e566c699a1be9bf159d90a6b42fad16d6c4f74b7315c262ed5e5897f09 The package lion-second-package was found to contain malicious code. Source: ghsa-malware...

Millensys Vision Tools Workspace 安全漏洞

Millensys Vision Tools Workspace is a medical imaging system software from Millensys, Egypt. A security vulnerability exists in Millensys Vision Tools Workspace version 6.5.0.2585, which stems from a lack of access control and could lead to the disclosure of sensitive configuration information an...

SUSE CVE-2025-60798

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $REQUEST'query' directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute...

RLSA-2025:20559 Low: shadow-utils security update

The shadow-utils packages include programs for converting UNIX password files to the shadow password format, as well as utilities for managing user and group accounts. Security Fixes: shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise CVE-2024-56433 For...

APIs Are the Retail Engine: How to Secure Them This Black Friday

Can you ever imagine the impact on your business if it went offline on Black Friday or Cyber Monday due to a cyberattack? Black Friday is the biggest day in the retail calendar. It’s also the riskiest. As you gear up for huge surges in online traffic, ask yourself: have you protected the APIs on...

CVE-2025-60797

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in dataexport.php at line 118. The application directly executes user-supplied SQL queries from the $REQUEST'query' parameter without any sanitization or parameterization via $data-conn-Execute$REQUEST'query'. An authenticated...

EUVD-2025-198265

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $REQUEST'query' directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute...

DEBIAN-CVE-2025-60798

phpPgAdmin 7.13.0 and earlier contains a SQL injection vulnerability in display.php at line 396. The application passes user-controlled input from $REQUEST'query' directly to the browseQuery function without proper sanitization. An authenticated attacker can exploit this vulnerability to execute...