Malicious code in cookiefunctions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8afa900a1619d7588b19e54f31e967476f48fc0d956d06cd6dd045d965d36a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AZL-65006 CVE-2025-38272 affecting package kernel 6.6.150.1-1

In the Linux kernel, the following vulnerability has been resolved: net: dsa: b53: do not enable EEE on bcm63xx BCM63xx internal switches do not support EEE, but provide multiple RGMII ports where external PHYs may be connected. If one of these PHYs are EEE capable, we may try to enable EEE for t...

DEBIAN-CVE-2025-38272

In the Linux kernel, the following vulnerability has been resolved: net: dsa: b53: do not enable EEE on bcm63xx BCM63xx internal switches do not support EEE, but provide multiple RGMII ports where external PHYs may be connected. If one of these PHYs are EEE capable, we may try to enable EEE for t...

Malicious code in dt-automation-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6eeff9a72134c244b969bcd674f473359fea30bfe4423298194db75e255a238 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Adobe ColdFusion < 2021.x < 2021u21 / 2023.x < 2023u15 / 2025.x < 2025u3 Multiple Vulnerabilities (APSB25-69)

The version of Adobe ColdFusion installed on the remote Windows host is prior to 2021.x update 21, 2023.x update 15, or 2025.x update 3. It is, therefore, affected by multiple vulnerabilities as referenced in the APSB25-69 advisory. - ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are...

📄 Schneider Electric EcoStruxure IT Data Center Expert 8.3 XML Injection

Schneider Electric EcoStruxure IT Data Center Expert versions 8.3 and below has a DataExchange route that allows the XML body of SOAP requests to contain references to external entities. This allows an unauthenticated attacker to read local files, perform server-side request forgery, and overwhel...

CVE-2021-27961

creationtimestamp| type| source ---|---|--- 2025-07-09 17:00:33+00:00| seen| https://gist.github.com/phlmox/c24bf28f12fbc0f2ea73dd9e8cfa94e3...

Malicious code in homiersla (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18b688a5a2d22b21d1e643d311c8364a0d6d26d28c537c6e4fbf1a00f7dc12ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vulnerabilities fixed in Adobe ColdFusion

Adobe has fixed vulnerabilities in ColdFusion Specifically for versions 25.2, 23.14, 21.20 and earlier. The vulnerabilities in ColdFusion include a significant vulnerability related to improper restriction of XML External Entity Reference XXE, hard-coded credentials, improper authorization, XML...

Open Redirect

better-auth is vulnerable to open redirect. The vulnerability is due to improper validation of user-supplied URLs in the originCheck middleware, which allows an attacker to redirect users to arbitrary external sites via crafted requests to routes such as /verify-email, /reset-password/:token,...

Security Bulletin: IBM Sterling External Authentication Server is vuulnerable due to path-to-regexp (CVE-2024-45296).

Summary IBM Sterling External Authentication Server uses the npm path-to-regexp, which is vulnerable to CVE-2024-45296. Vulnerability Details CVEID:CVE-2024-45296 DESCRIPTION: path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular...

Malicious code in grafana-iot-twinmaker-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7f0ee041fd32ff1222732d276760eea9a8547107ad0492a0654088ddfb85381 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in css-keylogger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d7d5c0eac76577da5186e985efd72018e773d9ada891e44852188b9e5cd8632 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Schneider Electric EcoStruxure IT Data Center Expert XML External Entities Injection

Vulnerability Details Affected Vendor: Schneider Electric Affected Product: EcoStruxure IT Data Center Expert Affected Version: 8.3 and prior Platform: CentOS CWE Classification: CWE-611: Improper Restriction of XML External Entity Reference CVE ID: CVE-2025-6438 2. Vulnerability Description The...

PT-2025-28854 · Undefined · Undefined

CVE-2025-53687 Rejected reason https://t.co/tDWKrpwRVz...

The vulnerability of the Akamai CloudTest performance testing platform lies in the improper limitation of XML links to external objects, which allows attackers to compromise privacy.

The vulnerability of the Akamai CloudTest performance testing platform relates to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to compromise privacy...

CVE-2025-49544

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or...

CVE-2025-49544

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information or...

CVE-2025-49535

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a Security feature bypass. An attacker could exploit this vulnerability to access sensitive information or denial of service b...

CVE-2025-49539

ColdFusion versions 2025.2, 2023.14, 2021.20 and earlier are affected by an Improper Restriction of XML External Entity Reference 'XXE' vulnerability that could result in a security feature bypass. A high-privileged attacker could leverage this vulnerability to access sensitive information...