Malicious code in @ra-ide/ld-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aec551eb9431424b0e79cb127427880ebd5c21b9deb2b8d4a378fb650fb45a84 The package @ra-ide/ld-frontend was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-190592 Malicious code in @ra-ide/ld-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aec551eb9431424b0e79cb127427880ebd5c21b9deb2b8d4a378fb650fb45a84 The package @ra-ide/ld-frontend was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2025-198329

Malicious code in @ra-ide/ld-frontend npm...

CVE-2025-63848

Stored cross site scripting xss vulnerability in SWISH prolog thru 2.2.0 allowing attackers to execute arbitrary code via crafted web IDE notebook...

CVE-2025-63848

The CVE-2025-63848 entry describes a stored XSS vulnerability in SWISH (SWI‑Prolog SWISH Web IDE) up to version 2.2.0. The issue allows an attacker to execute arbitrary code via a crafted notebook in the Web IDE, indicating code execution impact tied to the web interface. Affected component: SWIS...

PT-2025-47605

Name of the Vulnerable Software and Affected Versions SWISH prolog versions through 2.2.0 Description A stored cross site scripting issue exists in SWISH prolog through version 2.2.0. This allows attackers to execute arbitrary code through a specially crafted web IDE notebook. The issue involves...

Security Bulletin: Due to use of the sha.js library, IBM watsonx Code Assistant IDE Extensions is affected by Improper Input Validation vulnerability

Summary Sha.js is used internally by IBM watsonx Code Assistant IDE Extensions CVE-2025-9288 Vulnerability Details CVEID:CVE-2025-9288 DESCRIPTION: Improper Input Validation vulnerability in sha.js allows Input Data Manipulation.This issue affects sha.js: through 2.4.11. CWE:CWE-20: Improper Inpu...

CVE-2025-8386

The vulnerability, if exploited, could allow an authenticated miscreant with privilege of "aaConfigTools" to tamper with App Objects' help files and persist a cross-site scripting XSS injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The...

CVE-2025-8386

The vulnerability, if exploited, could allow an authenticated miscreant with privilege of "aaConfigTools" to tamper with App Objects' help files and persist a cross-site scripting XSS injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The...

EUVD-2025-197662

The vulnerability, if exploited, could allow an authenticated miscreant with privilege of "aaConfigTools" to tamper with App Objects' help files and persist a cross-site scripting XSS injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The...

CVE-2025-8386 AVEVA Application Server IDE Basic Cross-site Scripting

The vulnerability, if exploited, could allow an authenticated miscreant with privilege of "aaConfigTools" to tamper with App Objects' help files and persist a cross-site scripting XSS injection that when executed by a victim user, can result in horizontal or vertical escalation of privileges. The...

PT-2025-47034

Name of the Vulnerable Software and Affected Versions Application Server affected versions not specified Description An authenticated attacker with “aaConfigTools” privilege can modify App Objects’ help files, potentially leading to a persistent cross-site scripting XSS injection. Successful...

AVEVA Application Server IDE

RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to tamper with help files and inject cross-site scripting XSS code. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:...

Security Bulletin: Due to use of Axios, IBM watsonx Code Assistant IDE Extensions is affected by unbounded memory and denial of service

Summary Axios is used internally by IBM watsonx Code Assistant IDE Extensions CVE-2025-58754 Vulnerability Details CVEID:CVE-2025-58754 DESCRIPTION: Axios is a promise based HTTP client for the browser and Node.js. When Axios prior to versions 0.30.2 and 1.12.0 runs on Node.js and is given a URL...

Drupal Simple multi step form module < 2.0.0 - Authenticated Cross Site Scripting (XSS) vulnerability

Authenticated Cross Site Scripting XSS vulnerability discovered by Ide Braakman idebr in WordPress Module Simple multi step form versions 2.0.0...

CVE-2025-12501

Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application crashes through denial-of-service attacks DoS. GameMaker users who use the networkcreateserver function in their projects are urged to update and recompile immediately...

CVE-2025-12501

Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application crashes through denial-of-service attacks DoS. GameMaker users who use the networkcreateserver function in their projects are urged to update and recompile immediately...

CVE-2025-12501

Integer overflow in GameMaker IDE below 2024.14.0 version can lead to can lead to application crashes through denial-of-service attacks DoS. GameMaker users who use the networkcreateserver function in their projects are urged to update and recompile immediately...

CVE-2025-12501

CVE-2025-12501 concerns an integer overflow in GameMaker IDE for versions prior to 2024.14.0 that can cause application crashes via denial-of-service, particularly when using network_create_server() in affected projects. Connected sources (PT-2025-44627) confirm the vulnerable software and versio...

Opera GameMaker IDE 安全漏洞

Opera GameMaker IDE is an integrated development environment from Opera Norway. A security vulnerability exists in Opera GameMaker IDE versions prior to 2024.14.0 that stems from an integer overflow and could lead to a denial of service attack...