Fortinet FortiManager和Fortinet FortiAnalyzer 日志信息泄露漏洞

Fortinet FortiManager and Fortinet FortiAnalyzer are both products of Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains AD...

Security Bulletin: Vulnerability in FOS firmware used by IBM b-type SAN directors and switches.

Summary The b-type products are vulnerable due to an OpenSSL issue in the FOS firmware. The vulnerability has been addressed and can be resolved by applying the FOS code level listed below. Vulnerability Details CVEID:CVE-2023-6237 DESCRIPTION: OpenSSL is vulnerable to a denial of service, caused...

Prototype Pollution

Overview org.webjars.npm:parse-git-config is a Parse .git/config into a JavaScript object. sync or async. Affected versions of this package are vulnerable to Prototype Pollution via the expandKeys function. An attacker can obtain sensitive information by exploiting the improper handling of key...

SUSE-SU-2025:0849-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Updated to Mozilla Thunderbird 128.8 MFSA 2025-18 bsc1237683: - CVE-2024-43097: Overflow when growing an SkRegion's RunArray - CVE-2025-1930: AudioIPC StreamData could trigger a use-after-free in the Browser process - CVE-2025-1931:...

CLSA-2025-1741787087 openssl: Fix of CVE-2023-6237

CVE-2023-6237: optimize computation time for RSA modulus to avoid possible denial of service while checking excessively long invalid RSA public keys...

MAL-2025-2327 Malicious code in rolldownload (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e57796af333715605cb3404f3d8653189e6859e7d409e69670109ab17dad2ff Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in client-analytisc-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1413ae1456fe5f357befbd198d3c85b98e8d40e31b0d76c343d1cb6a9dfc9d95 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2325 Malicious code in rc-upload-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e8c8a04b14788b037fccbfd5f9be8c5f83d54da6321b13d213287d683a937baf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in spectrocoin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 290b36acd27bae687a488826038fdc7f97273030fd80026b3bd796793c70df5f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2312 Malicious code in expect-violations (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d98ae6c06bd6b1cd2115956a382b7cdd4a1901560535df9f8284ef29cb6a4550 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mozilla Thunderbird Code Issue Vulnerability

Mozilla Thunderbird is the United States Mozilla Foundation's set of independent from the Mozilla Application Suite e-mail client software. The program supports IMAP, POP mail protocols and HTML mail format. A code issue vulnerability exists in Mozilla Thunderbird versions prior to 136 and prior ...

The vulnerability of the Thunderbird email client, related to incorrect import of OpenPGP keys from the WKD server, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Thunderbird email client is related to the improper import of the OpenPGP key from the WKD server. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

MAL-2025-2287 Malicious code in www-discoveryeducation-com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5b81d0d31dd0c1ad59b382392dd3309ca9d6ca9ccafde5ab54ee3c7a4c38fb20 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2261 Malicious code in init-spa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b819e1e4ec37a2916d54fc1cccc8d0a57a4c0fc53653d0caf06fe86826f0992b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2272 Malicious code in radar-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e3c3b76c65176007f3c376c09b22d085bc9fba8527c7b806acca53816e6cebf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2275 Malicious code in referrals-landing-page (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af44c1859de435203a802f9ebc54d261a9baa1c82b581c6735726c322cff737e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

This Malicious PyPI Package Stole Ethereum Private Keys via Polygon RPC Transactions

Cybersecurity researchers have discovered a malicious Python package on the Python Package Index PyPI repository that's equipped to steal a victim's Ethereum private keys by impersonating popular libraries. The package in question is set-utils, which has received 1,077 downloads to date. It's no...

CVE-2025-27650

Vasion Print formerly PrinterLogic before Virtual Appliance Host 22.0.862 Application 20.0.2014 allows Private Keys in Docker Overlay V-2023-013...

Malicious code in testnet-contracts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware edd3718e0e37096149d4d64985025d95be3edcd077f04cf23ed0165b2b8b8b8d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Over 1,000 WordPress Sites Infected with JavaScript Backdoors Enabling Persistent Attacker Access

Over 1,000 websites powered by WordPress have been infected with a third-party JavaScript code that injects four separate backdoors. "Creating four backdoors facilitates the attackers having multiple points of re-entry should one be detected and removed," c/side researcher Himanshu Anand said in ...