EUVD-2025-36827

Malicious code in pensions-portals-fe npm...

MAL-2025-49029 Malicious code in pensions-portals-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9025d84d3de41f55102920c25c5229e8104e159e23a3e943a7e955077ae61403 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pensions-portals-fe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9025d84d3de41f55102920c25c5229e8104e159e23a3e943a7e955077ae61403 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-62248

A reflected cross-site scripting XSS vulnerability, resulting from a regression, has been identified in Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.1 through...

EUVD-2008-0743

Malware in sbrugna...

Scanning Activity on Palo Alto Networks Portals Jump 500% in One Day

Threat intelligence firm GreyNoise disclosed on Friday that it has observed a massive spike in scanning activity targeting Palo Alto Networks login portals. The company said it observed a nearly 500% increase in IP addresses scanning Palo Alto Networks login portals on October 3, 2025, the highes...

EUVD-2024-2468

Malicious code in bioql PyPI...

EUVD-2023-1899

Malicious code in bioql PyPI...

Hackers Exploit Milesight Routers to Send Phishing SMS to European Users

Unknown threat actors are abusing Milesight industrial cellular routers to send SMS messages as part of a smishing campaign targeting users in European countries since at least February 2022. French cybersecurity company SEKOIA said the attackers are exploiting the cellular router's API to send...

Scammers are impersonating the FBI to steal your personal data

Been scammed? Hoping to report it to the FBI? Definitely do so, but be careful. Spoofed versions of the FBI's Internet Crime Complaint Center IC3 website are now circulating online, and they lead straight back to the scammers. The FBI issued an advisory last week, warning that cybercriminals are...

CVE-2025-43805

Liferay Portal 7.3.0 through 7.4.3.111, and Liferay DXP 2023.Q4.0, 2023.Q3.1 through 2023.Q3.4, 7.4 GA through update 92, and 7.3 GA through update 35 does not perform an authorization check when users attempt to view a display page template, which allows remote attackers to view display page...

Why XSS still matters: MSRC’s perspective on a 25-year-old threat

Cross-Site Scripting XSS has been a known vulnerability class for two decades, yet it continues to surface in modern applications, including those built with the latest frameworks and cloud-native architectures. At Microsoft, we still receive a steady stream of XSS reports across our services, fr...

CVE-2025-52352

Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option on the login page UI. However, the sign-up API endpoint remains publicly accessible and functional, allowing unauthenticated users to...

CVE-2025-43742

CVE-2025-43742 is a reflected XSS vulnerability affecting Liferay Portal 7.4.0–7.4.3.132 and Liferay DXP releases listed (2025.Q1.0–2025.Q1.3, 2024.Q4.0–Q4.7, 2024.Q3.1–Q3.13, 2024.Q2.0–Q2.13, 2024.Q1.1–Q1.14, and 7.4 GA through update 92). An unauthenticated remote attacker can inject JavaScript...

Arista Networks CloudVision Portal 安全漏洞

Arista Networks CloudVision Portal is a suite of web-based user management portals for the CloudVision platform from Arista Networks, USA. The product includes features such as network device configuration, compliance management, change management, and network monitoring management. A security...

How to Bring Zero Trust to Wi-Fi Security with a Cloud-based Captive Portal?

Recent data breaches have highlighted the critical need to improve guest Wi-Fi infrastructure security in modern business environments. Organizations face increasing pressure to protect their networks while providing convenient access to visitors, contractors, temporary staff, and employees with...

A Bootiful Podcast: Intact's Luke Shannon

Hi, Spring fans! and happy holidays! in this installment I talk to Intact's Luke Shannon about their use of Spring, developer portals, and so much more...

The vulnerability of the AWS S3 platform’s module for developer portals allows attackers to bypass security restrictions and gain unauthorized access to protected information.

The vulnerability of the AWS S3 platform’s module for developer portals developed by Backstage relates to an incorrect restriction on the path name to the restricted catalog. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and gain unauthorized access to...

A Bootiful Podcast: Intact's Luke Shannon

Hi, Spring fans! and happy holidays! in this installment I talk to Intact's Luke Shannon about their use of Spring, developer portals, and so much more...

Malicious code in rn-native-portals (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9cc76bce72b94e6ae0b2f629d3fc88141eeebe2e6d7f59c886a7ca7b8ec6d078 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...