MAL-2025-49126 Malicious code in epic-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 512b2df44075983b7f2a23a8151b414a43cb02a59ab726e6ba6db3c6c4874d01 The package epic-config was found to contain malicious code...

MAL-2025-49241 Malicious code in store-webpack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f10add046b94b627520507423f73982964e7be0734c7b4909acee5710f1e7e The package store-webpack-config was found to contain malicious code...

Malicious code in store-webpack-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 13f10add046b94b627520507423f73982964e7be0734c7b4909acee5710f1e7e The package store-webpack-config was found to contain malicious code...

CVE-2025-64144

Jenkins ByteGuard Build Actions Plugin 1.0 stores API tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system...

CVE-2025-64146

Jenkins Curseforge Publisher Plugin 1.0 stores API Keys unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Item/Extended Read permission, or access to the Jenkins controller file system...

CVE-2025-11906

A vulnerability exists in Progress Flowmon versions prior 12.5.6 where certain system configuration files have incorrect file permissions, allowing a user with access to the default flowmon system user account used for SSH access to potentially escalate privileges to root during service...

CVE-2025-11906

CVE-2025-11906 affects Progress Flowmon versions prior to 12.5.6. The root cause is incorrect file permissions on system configuration files, allowing a user with access to the default Flowmon SSH account to potentially escalate privileges to root during service initialization. Impact is privileg...

EUVD-2025-36725

On affected platforms, restricted users could view sensitive portions of the config database via a debug API e.g., user password hashes...

PT-2025-44476

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to CCM 3.1.2 Nagios XI versions prior to 5.8.4 Description The Core Config Manager CCM in Nagios XI is susceptible to a cross-site scripting XSS issue through the lock page functionality. A lack of proper input...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from the US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems and more. A security vulnerability exists in Nagios XI CCM versions prior to version 3.1.1 and Nagios XI version 5.8....

PT-2025-44548

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.7.2 Description Nagios XI versions prior to 5.7.2 are susceptible to cross-site scripting XSS through the Business Process Intelligence BPI component’s Config Management and Edit Config page. Insufficient validati...

PT-2025-44474

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to CCM 3.1.1 Nagios XI versions prior to 5.8.2 Description The Core Config Manager CCM in Nagios XI is susceptible to multiple cross-site scripting XSS issues within Overlay modals. A lack of proper input validation or...

PT-2025-44477

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to CCM 3.1.3 Nagios XI versions prior to 5.8.5 Description The Core Config Manager CCM contains a SQL injection issue in how search text is handled. User-supplied input is not properly sanitized before being used in SQ...

PT-2025-44478

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to CCM 3.1.4 Nagios XI versions prior to 5.8.6 Description The Core Config Manager CCM in Nagios XI is subject to a reflected cross-site scripting XSS issue through the Test Command functionality. A lack of proper inpu...

PT-2025-44465

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to CCM 3.0.7 Nagios XI versions prior to 5.7.4 Description The Core Config Manager CCM in Nagios XI has multiple SQL injection flaws present in the object edit pages. The application incorporates unsanitized...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 5.7.2 that stems from the Config Management and...

CVE-2025-61141

The CVE-2025-61141 entry concerns sqls-server/sqls version 0.2.28, which is vulnerable to command injection in the config command. The root cause is that openEditor passes the EDITOR environment variable and the config file path to sh -c without sanitization, enabling an attacker to execute arbit...

Nagios XI 安全漏洞

Nagios XI is a suite of IT infrastructure monitoring solutions from US-based Nagios. The solution supports monitoring and alerting of applications, services, operating systems, and more. A security vulnerability exists in Nagios XI versions prior to 2026R1, which stems from insufficient validatio...

PT-2025-44462

Name of the Vulnerable Software and Affected Versions Nagios XI versions prior to 5.6.14 Description Nagios XI versions prior to 5.6.14 have an authenticated remote command execution issue in the command test.php script within the Core Config Manager CCM. A lack of proper validation of the addres...

PT-2025-44375

Name of the Vulnerable Software and Affected Versions Progress Flowmon versions prior to 12.5.6 Description A flaw exists in Progress Flowmon where system configuration files have incorrect file permissions. A user with access to the default flowmon system user account used for SSH access could...