2555 matches found
CVE-2025-65099 Claude Code vulnerable to command execution prior to startup trust dialog
Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a us...
CVE-2025-65099 Claude Code vulnerable to command execution prior to startup trust dialog
Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a us...
CVE-2025-65099 Claude Code vulnerable to command execution prior to startup trust dialog
Claude Code is an agentic coding tool. Prior to version 1.0.39, when running on a machine with Yarn 3.0 or above, Claude Code could have been tricked to execute code contained in a project via yarn plugins before the user accepted the startup trust dialog. Exploiting this would have required a us...
Claude Code 代码注入漏洞
Claude Code is an open source proxy coding tool from Anthropic. A code injection vulnerability exists in Claude Code versions prior to 1.0.39, which stems from the possibility of executing project code via the yarn plugin without the user having to accept the startup trust dialog in Yarn 3.0 and...
PT-2025-47513
Name of the Vulnerable Software and Affected Versions Claude Code versions prior to 1.0.39 Description Prior to version 1.0.39, Claude Code could be tricked into executing code contained in a project through Yarn plugins before the user accepted the startup trust dialog, when running on a machine...
Release Information for Veeam ONE 13.0.1 RTM Patch 0
Update Applicability This "Patch 0" update for Veeam ONE 13.0.1 is strictly intended for deployments using the RTM release build 13.0.1.5860. If Veeam ONE 13.0.1 GA build 13.0.1.5924 is installed, this update can be ignored as it is not needed. All resolved issues listed in this article were foun...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Changes dialog. An attacker can execute arbitrary scripts in the context of another authenticated user's session by injecting malicious code into page titles or usernames, which is then triggered when...
CVE-2025-65012
Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the...
CVE-2025-65012 Kirby CMS has cross-site scripting (XSS) in the changes dialog
Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the...
CVE-2025-65012 Kirby CMS has cross-site scripting (XSS) in the changes dialog
Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the...
CVE-2025-65012
Kirby CMS 5.0.0–5.1.3 contains a cross-site scripting (XSS) vulnerability in the Changes dialog. An attacker with authenticated Panel user access can corrupt a page title or username with a malicious string, then modify related content fields; when another authenticated user opens the dialog, the...
CVE-2025-65012 Kirby CMS has cross-site scripting (XSS) in the changes dialog
Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the...
EUVD-2025-198062
Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the...
Kirby CMS has cross-site scripting (XSS) in the changes dialog
TL;DR This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames. The attack requires user interaction by another Panel user and cannot be automated. ---- Introductio...
GHSA-84HF-8GH5-575J Kirby CMS has cross-site scripting (XSS) in the changes dialog
TL;DR This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames. The attack requires user interaction by another Panel user and cannot be automated. ---- Introductio...
EUVD-2025-44076
Malicious code in @rce-web/ui-upgrade-dialog npm...
MAL-2025-55023 Malicious code in @rce-web/ui-upgrade-dialog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57e62e8b0f953b91fb74e52a2d70374df46b221c1d7cc57bcc80e0671cf32796 The package @rce-web/ui-upgrade-dialog was found to contain malicious code. Source: ossf-package-analysis...
Malicious code in @rce-web/ui-upgrade-dialog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 57e62e8b0f953b91fb74e52a2d70374df46b221c1d7cc57bcc80e0671cf32796 The package @rce-web/ui-upgrade-dialog was found to contain malicious code. Source: ossf-package-analysis...
MAL-2025-49127 Malicious code in epic-consent-dialog (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0ab01762eb52cfb3e852d9ab46d5f8216fb6ef716a47c97f247a4a99f68abaca The package epic-consent-dialog was found to contain malicious code...