MAL-2025-2139 Malicious code in vue-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0efc0a22034000a68b77f7b5cfddbb864cc72d9bb239e7fe1af0feb7643d1ae3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

IBM EntireX Path Traversal Vulnerability

IBM EntireX is a cross-platform application integration middleware developed by IBM to support data communication and transaction processing between heterogeneous systems. A path traversal vulnerability exists in IBM EntireX, which can be exploited by an attacker to view arbitrary files on a syst...

libreoffice -- Macro URL arbitrary script execution

[email protected] reports: LibreOffice supports Office URI Schemes to enable browser integration of LibreOffice with MS SharePoint server. An additional scheme 'vnd.libreoffice.command' specific to LibreOffice was added. In the affected versions of LibreOffice a link in a browser...

Malicious code in paypal-expanded-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-1913 Malicious code in paypal-expanded-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in paypal-sdk-server-side-integration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7cbb479a86e79945f77f69a5ee3fa04d2ed76af23ea3bc9de04b02ed5cc0b4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-13358

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bpdeletepage function in all versions up to, and including, 3.4.24. This makes it possible for authenticated...

CVE-2025-1780

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bpdeletepage function in all versions up to, and including, 3.4.25. This makes it possible for authenticated...

CVE-2024-13358

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bpdeletepage function in all versions up to, and including, 3.4.24. This makes it possible for authenticated...

CVE-2025-1780 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.25 - Cross-Site Request Forgery to Limited Settings Update

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bpdeletepage function in all versions up to, and including, 3.4.25. This makes it possible for authenticated...

CVE-2024-13358 BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages <= 3.4.24 - Missing Authorization to Authenticated (Subscriber+) Limited Settings Update

The BuddyPress WooCommerce My Account Integration. Create WooCommerce Member Pages plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wc4bpdeletepage function in all versions up to, and including, 3.4.24. This makes it possible for authenticated...

CVE-2024-13358

CVE-2024-13358 affects the BuddyPress WooCommerce My Account Integration (WC4BP) plugin for WordPress, with all versions up to 3.4.24 vulnerable to unauthorized access due to a missing capability check in wc4bp_delete_page(), allowing authenticated attackers with Subscriber-level access or higher...

WordPress plugin BuddyPress WooCommerce My Account Integration 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

The vulnerability of the software for data integration and analytics in Hitachi Vantara Pentaho Data Integration & Analytics lies in improper management of resource identifiers. This allows attackers to disclose sensitive information, gain elevated privileges, and execute arbitrary code.

The vulnerability of the Hitachi Vantara Pentaho Data Integration & Analytics software for data integration and analysis is related to improper management of resource identifiers. Exploiting this vulnerability can allow a malicious actor to disclose protected information, enhance their privileges...

CVE-2025-27414

MinIO is a high performance object storage. Starting in RELEASE.2024-06-06T09-36-42Z and prior to RELEASE.2025-02-28T09-55-16Z, a bug in evaluating the trust of the SSH key used in an SFTP connection to MinIO allows authentication bypass and unauthorized data access. On a MinIO server with SFTP...

Malicious code in paypal-checkout-integration-backend-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8978fb3635d1339256e1aa90eab3f76ba33bad36f9a2ffd70d1f6fc7d60ccca8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-9193

The WHMpress - WHMCS WordPress Integration Plugin plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 6.3-revision-0 via the whmpressdomainsearchajaxextendedresults function. This makes it possible for unauthenticated attackers to include and execute...

The vulnerability of the software for data integration and analysis in Hitachi Vantara Pentaho Data Integration & Analytics lies in the insufficient protection of registration data, which allows attackers to disclose confidential information.

The vulnerability of the software for data integration and analytics in Hitachi Vantara Pentaho Data Integration & Analytics relates to insufficient protection of registration data. Exploiting this vulnerability could allow a malicious actor to disclose confidential information...

DEBIAN-CVE-2025-21809

In the Linux kernel, the following vulnerability has been resolved: rxrpc, afs: Fix peer hash locking vs RCU callback In its address list, afs now retains pointers to and refs on one or more rxrpcpeer objects. The address list is freed under RCU and at this time, it puts the refs on those peers...

Why MDR In 2025 Is About Scaling With Purpose

Forrester recently released “The Forrester Wave™: Managed Detection and Response MDR Services, Q1 2025,", highlighting the top 10 MDR providers out of more than 600 worldwide. While we’re honored to be recognized in such a competitive market, Rapid7’s designation underscores a fundamental...