Malicious code in sick_porpoise_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5abeab42cf71bd05870bc314de12fd4b578d7e0cbab2703e79f798329cb812ee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in zaki-klipo56-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c083f7c8b54f925b1909a5ce62902e8c9f9a8698eea78f6715bfd14f2985dda7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in mulyono-miebogor54-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d4f8e44f6163f8b5b9137d5dc0deddb5cfd2cafe6462bb51df286c468438f929 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in rina-wajit82-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6a851d3aebb2df415e9634e5dcd5c69830c9b8bcd66d6d33bd0327d2550e25c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-66526 Malicious code in zul-mieaceh89-sluey (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e8ffb16d6edc65f56d445fc5e6e3b3c9ed48a9fec7c1e9b18aab8f87dafa409d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-49145

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

CVE-2025-49145 iTop admin can drop iTop database using webhooks

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

CVE-2025-49145 iTop admin can drop iTop database using webhooks

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

CVE-2025-49145

Combodo iTop vulnerability CVE-2025-49145 affects iTop versions prior to 2.7.13 and 3.2.2. A user with sufficient rights to create webhooks (typically administrators) can trigger database deletion due to unverified callback signatures. The issue is mitigated in iTop by upgrading to 2.7.13 or 3.2....

EUVD-2025-50822

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

CVE-2025-49145 iTop admin can drop iTop database using webhooks

Combodo iTop is a web based IT service management tool. In versions prior to 2.7.13 and 3.2.2, a user that has enough rights to create webhooks mostly administrators can drop the database. This is fixed in iTop 2.7.13 and 3.2.2 by verifying callback signature...

Malicious code in practical_bedbug_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00fc45f0d0d0b2ba9da3f61456a2a0d4bf98e338208e9771093772765fda01a8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in fajar-ragi67-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c2ac2913c10c7f81cd7ba2a1a28ad7fef1a5abb70d39239bd0ec7025c96c1102 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-56781 Malicious code in ida-nasiuduk37-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 558c842ebf4ef41c754fb9b8109be6847fa7ca90c8c8f432fa9be25d719a62ae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bella-gudeg93-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 517ae417d782b62b3c8cc38ca713a8261dfef709d48953b99333ae303f331b2a The package bella-gudeg93-riris was found to contain malicious code. This package appears to be part of the tea.xyz token reward campaign that floode...

[SECURITY] Fedora 43 Update: uv-0.9.7-2.fc43

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

PT-2025-46196

Name of the Vulnerable Software and Affected Versions Combodo iTop versions prior to 2.7.13 Combodo iTop versions prior to 3.2.2 Description Combodo iTop is a web-based IT service management tool. A user with sufficient privileges to create webhooks typically administrators can drop the database...

privatebin XSS

privatebin reports: Dragging a file whose filename contains HTML is reflected verbatim into the page via the drag-and-drop helper, so any user who drops a crafted file on PrivateBin will execute arbitrary JavaScript within their own session self-XSS. This allows an attacker who can entice a victi...

CVE-2025-53283

Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag File Uploader Addon:...

CVE-2025-53283

Unrestricted Upload of File with Dangerous Type vulnerability in borisolhor Drop Uploader for CF7 - Drag&Drop File Uploader Addon drop-uploader-for-contact-form-7-dragdrop-file-uploader-addon allows Upload a Web Shell to a Web Server.This issue affects Drop Uploader for CF7 - Drag&Drop File...