Malicious Package

Overview mathy-console is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Linux Distros Unpatched Vulnerability : CVE-2021-41244

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana is an open-source platform for monitoring and observability. In affected versions when the fine- grained access control beta feature is enabled and ther...

InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the authorization resource of the default organization to retrieve the operator token. InfluxDB OSS 1.x, Enterprise, Cloud, Cloud Dedicated and Clustered are not affected. NOTE: The researcher states that InfluxDB allows allAccess administrators to retrieve all raw tokens via an "influx auth ls" command. The supplier indicates that the organizations feature is operating as intended and that users may choose to add users to non-default organizations. A future release of InfluxDB 2.x will remove the ability to retrieve tokens from the API.

...

Linux Distros Unpatched Vulnerability : CVE-2023-4822

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Grafana is an open-source platform for monitoring and observability. The vulnerability impacts Grafana instances with several organizations, and allows a user...

CVE-2024-32832

The CVE-2024-32832 entry corresponds to a Broken Access Control vulnerability in the WordPress plugin Login with phone number (versions

CVE-2025-9715

A vulnerability was found in O2OA up to 10.0-410. Affected is an unknown function of the file /xcmsassemblecontrol/jaxrs/script of the component Personal Profile Page. The manipulation of the argument name/alias/description results in cross site scripting. The attack can be launched remotely. The...

Linux Distros Unpatched Vulnerability : CVE-2019-20397

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A double-free is present in libyang before v1.0-r1 in the function yyparse when an organization field is not terminated. Applications that use libyang to parse...

Linux Distros Unpatched Vulnerability : CVE-2024-30896

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - InfluxDB OSS 2.x through 2.7.11 stores the administrative operator token under the default organization which allows authorized users with read access to the...

Malicious Package

Overview apollo-ms is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

CVE-2025-43739

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent...

CVE-2025-4046

A missing authorization vulnerability in Lexmark Cloud Services badge management allows attacker to reassign badges within their organization...

CVE-2025-43732

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.10, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.17 and 7.4 GA through update 92 is vulnerable to Insecure Direct Object Reference IDOR in the...

WellChoose Organization Portal System SQL Injection Vulnerability

WellChoose Organization Portal System is an electronic directory service system from WellChoose in Taiwan, China. The WellChoose Organization Portal System suffers from a SQL injection vulnerability that arises from the application's lack of validation of externally entered SQL statements. The...

WellChoose Organization Portal System File Inclusion Vulnerability

WellChoose Organization Portal System is an electronic directory service system from WellChoose in Taiwan, China. A file inclusion vulnerability exists in the WellChoose Organization Portal System, which can be exploited by an attacker to execute arbitrary code on the server due to a failure to...

WellChoose Organization Portal System Cross-Site Scripting Vulnerability (CNVD-2025-19588)

WellChoose Organization Portal System is an electronic directory service system from WellChoose in Taiwan, China. The WellChoose Organization Portal System suffers from a cross-site scripting vulnerability that originates from the application's lack of effective filtering and escaping of...

WellChoose Organization Portal System Path Traversal Vulnerability

WellChoose Organization Portal System is an electronic directory service system from WellChoose in Taiwan, China. The WellChoose Organization Portal System suffers from a path traversal vulnerability that can be exploited by an attacker to download arbitrary system files...

WellChoose Organization Portal System Cross-Site Scripting Vulnerability

WellChoose Organization Portal System is an electronic directory service system from WellChoose in Taiwan, China. A cross-site scripting vulnerability exists in the WellChoose Organization Portal System that can be exploited by an attacker to execute arbitrary JavaScript code in a user's browser...

Liferay Portal Email Modification Vulnerability via Calendar Portlet

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent...

CVE-2025-43739

Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0 through 2025.Q1.6, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.16 and 7.4 GA through update 92 allow any authenticated user to modify the content of emails sent...

CVE-2025-4046

A missing authorization vulnerability in Lexmark Cloud Services badge management allows attacker to reassign badges within their organization...