MAL-2025-291 Malicious code in design-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7a60ac481f3005406c24eaaf2970a7d6d349201ce49fed87277a9436b52bddc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CISA and FBI Release Updated Guidance on Product Security Bad Practices

In partnership with the Federal Bureau of Investigation FBI, CISA released an update to joint guidance Product Security Bad Practices in furtherance of CISA’s Secure by Design initiative. This updated guidance incorporates public comments CISA received in response to a Request for Information,...

CVE-2025-23567

Cross-Site Request Forgery CSRF vulnerability in Tamer Ziady GDReseller gdreseller allows Stored XSS.This issue affects GDReseller: from n/a through = 1.6...

CVE-2025-23567 WordPress GDReseller plugin <= 1.6 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tamer Ziady GDReseller gdreseller allows Stored XSS.This issue affects GDReseller: from n/a through = 1.6...

CVE-2025-23567

CVE-2025-23567 is a CSRF-to-Stored XSS in the GDReseller WordPress plugin, affecting versions up to 1.6. Red Hat and ENISA records corroborate the vulnerability and indicate an unpatched state; CVSS v3.1 base score is 7.1 (High) . The description notes CSRF to Stored XSS without details on a fixe...

CVE-2025-23424

CVE-2025-23424 affects the Marquee Style RSS News Ticker plugin. Connected sources indicate a Cross-Site Request Forgery (CSRF) vulnerability that can lead to a Stored Cross-Site Scripting (XSS) condition in Marquee Style RSS News Ticker versions up to 3.2.0. The CVSS baseline is 7.1 (AV:N/AC:L/P...

CISA and Partners Release Call to Action to Close the National Software Understanding Gap

Today, CISA—in partnership with the Defense Advanced Research Projects Agency DARPA, the Office of the Under Secretary of Defense for Research and Engineering OUSD R&E, and the National Security Agency NSA—published Closing the Software Understanding Gap. This report urgently implores the U.S...

PT-2025-4944 · Intuitive Design · Intuitive Design Gdreseller

Name of the Vulnerable Software and Affected Versions: Intuitive Design GDReseller versions prior to 1.6 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web applicatio...

aldryn-django (=5.0.10.0), artd-customer (>=0.0.20 <=0.0.23) +65 more potentially affected by CVE-2024-56374 via django (>=5.0.0 <=5.0.10)

django PYPI version =5.0.0, =0.0.20, =0.0.13, =0.0.19, =0.0.34, =0.0.50, =0.0.5, =0.0.11, =1.0.3, =1.0.0, =6.0.0, =2.8.1, =0.3.0, =0.35.0 and more Source cves: CVE-2024-56374 Source advisory: SNYK:PYTHON-DJANGO-8623541...

CISA: Secure by Demand: Priority Considerations

This is CISA's Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products. This guide is intended to help owners and operators procure Operational Technology OT products, particularly industrial automation and control system products,...

CISA and US and International Partners Publish Guidance on Priority Considerations in Product Selection for OT Owners and Operators

Today, CISA—along with U.S. and international partners—released joint guidance Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products. As part of CISA’s Secure by Demand series, this guidance focuses on helping customers identify...

The vulnerability of the Woocommerce Product Design plugin of the WordPress content management system arises from incorrect restrictions on the path to the restricted catalog. This allows attackers to gain access to read, modify, or delete data.

The vulnerability of the Woocommerce Product Design plugin in the WordPress content management system is related to an incorrect restriction on the path to the restricted catalog. Exploiting this vulnerability could allow a malicious actor to gain access to read, modify, or delete data...

The vulnerability of the software for discrete event simulation and automation in Rockwell Automation Arena allows a intruder to execute arbitrary code by exploiting incorrect resource initialization.

The vulnerability of the software for discrete event simulation and automation in Rockwell Automation Arena is related to incorrect initialization of resources. Exploiting this vulnerability allows an attacker to execute arbitrary code using a specially created DOE file...

[SECURITY] Fedora 40 Update: gimp-2.10.38-12.fc40

GIMP GNU Image Manipulation Program is a powerful image composition and editing program, which can be extremely useful for creating logos and other graphics for web pages. GIMP has many of the tools and filters you would expe ct to find in similar commercial offerings, and some interesting extras...

The vulnerability of the DWFX software file used for viewing 3D models and project documents in Autodesk Navisworks Freedom; the software for modeling and analyzing 3D models in Autodesk Navisworks Simulate; and the software for analyzing, coordinating, and verifying 3D models and project data in Autodesk Navisworks Manage. This allows a malicious individual to cause service interruptions or execute arbitrary code.

The vulnerability of the DWFX software file used for viewing 3D models and project documents in Autodesk Navisworks Freedom, as well as the software for modeling, analyzing, and coordinating 3D models and project data in Autodesk Navisworks Manage, is related to a buffer overflow in the dynamic...

The vulnerability of the DWFX software file used for viewing 3D models and project documents in Autodesk Navisworks Freedom; the software for modeling and analyzing 3D models in Autodesk Navisworks Simulate; and the software for analyzing, coordinating, and verifying 3D models and project data in Autodesk Navisworks Manage. This allows a malicious individual to cause service interruptions or execute arbitrary code.

The vulnerability of the DWFX software file used for viewing 3D models and project documents in Autodesk Navisworks Freedom, as well as the software for modeling, analyzing, and coordinating 3D models and project data in Autodesk Navisworks Manage, is related to a buffer overflow in the dynamic...

CVE-2025-22353

CVE-2025-22353 is a Reflected XSS in Balcom-Vetillo Design, Inc. BVD Easy Gallery Manager for WordPress. Affects BVD Easy Gallery Manager: from n/a through 1.0.6. Root cause: improper neutralization of input during web page generation. Impact per description: XSS in the victim’s browser when view...

TrueWinter simofa 访问控制错误漏洞

TrueWinter simofa is a tool from TrueWinter to help automate the building and deployment of static websites. An access control error vulnerability exists in versions of TrueWinter simofa prior to 0.2.7 that stems from a design error in the RouteLoader class, where some API routes may be publicly...

CVE-2020-9236

There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. Attackers can exploit this vulnerability to perform malicious operatation to compromise module service. Vulnerability ID: HWPSIRT-2020-0501...

CVE-2020-9236

There is an improper interface design vulnerability in Huawei product. A module interface of the impated product does not deal with some operations properly. Attackers can exploit this vulnerability to perform malicious operatation to compromise module service. Vulnerability ID: HWPSIRT-2020-0501...