Malicious code in obfuscated (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d559efbc8df5a64ca2676526a199174c0a877291c1cd08cfb8db6a7536aad530 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in raydium-sdk-v6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15f2bf4f7d00a9a160e45525fc4b09ccf0957db423f83602f0e2aa72dde0ff2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-36506

External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted request, arbitrary files in the file system can be overwritten with log data...

Malicious code in mdp-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9dbfb2d3ae272dd0bda3bab2d03d7f1461dc50e5b834fd48ab7510f7e55b2a5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-1244: External Control of File Name or Path

Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2...

CVE-2024-1243: External Control of File Name or Path

Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for...

CVE-2025-47956

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...

CVE-2025-33053

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network...

Malicious code in ve-vores (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dcef286db1ecd73863ccb186a0860866493f59111555883f1eeea823933a163f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mockup-js-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d47de2f1ea832ed5ca1de7b318fac1b4e38fd7f83c2b66d97c4c38cfab1da216 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in meteor-react-component (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 10edb5e94e2b6aede51af9b2525726341571187cb32e9a56e9b86639c7130341 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in listenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4140488867aa92de02b72ad33c7ef4a3ed4329fa8de9b7bfe1a4e64d0bd81d70 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in javascript-heap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83e06344668ac9569d6453b98d15e492e35ad313b880f085c08f7600b977a837 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-33053: External Control of File Name or Path

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network...

CVE-2025-47956: External Control of File Name or Path

External control of file name or path in Windows Security App allows an authorized attacker to perform spoofing locally...

Microsoft Windows External Control of File Name or Path Vulnerability

Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files...

CVE-2025-33053

External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. Recent assessments: cbeek-r7 at June 12, 2025 6:57am UTC reported: CVE-2025-33053 is a zero-day vulnerability that enables remote code execution RCE through abuse of ho...

VulnCheck KEV: CVE-2025-33053

Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files...

Important: dotnet8.0

Issue Overview: External control of file name or path in .NET, Visual Studio, and Build Tools for Visual Studio allows an authorized attacker to perform spoofing over a network. CVE-2025-26646 Affected Packages: dotnet8.0 Issue Correction: Run dnf update dotnet8.0 --releasever 2023.7.20250609 to...

External Control of File Name or Path

Overview elmsln/haxcms is a Headless CMS for managing and publishing hybrid static, web component driven sites. Affected versions of this package are vulnerable to External Control of File Name or Path via the location parameter in the saveOutline API endpoint. An attacker can read arbitrary file...