MAL-2025-2112 Malicious code in latoken-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 114715a83c1f9537c15f2feab2c357a4cece3c946d5295dd133ee53efb347fd6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Westermo EDW-100 Use of Hard-Coded Password (CVE-2024-36080)

Westermo EDW-100 has a hidden administrator account with a hardcoded password. In the firmware package, in 'image.bin', the username root and the password for this account are both hard-coded and exposed as strings that can trivially be extracted. Currently there is no way to change this password...

New Malware Campaign Exploits Microsoft Graph API to Infect Windows

FortiGuard Labs discovers an advanced attack using modified Havoc Demon and SharePoint. Explore the attack's evasion techniques and security measures...

PT-2025-9179 · Ibm · Ibm Controller

Name of the Vulnerable Software and Affected Versions: IBM Controller versions 11.0.0 through 11.0.1 IBM Controller version 11.1.0 Description: The issue makes it easier for attackers to compromise user accounts because it does not require strong passwords by default. Recommendations: For IBM...

API Armor: How Bybit’s Real-Time Blacklisting Is Thwarting a $1.5B Crypto Heist

APIs present a security risk—that much is a given. Attacks on APIs have caused some of the most significant security incidents of the past decades. But the question now is: How can we flip the script and leverage their power to enhance security? Bybit might just have the answer. Bybit—one of the...

Schneider Electric communication modules for Modicon M580 and Quantum controllers (Update B)

GENERAL SECURITY RECOMMENDATIONS We strongly recommend the following industry cybersecurity best practices. https://www.se.com/us/en/download/document/7EN52-0390/ Locate control and safety system networks and remote devices behind firewalls and isolate them from the business network. Install...

CVE-2022-49125

In the Linux kernel, the following vulnerability has been resolved: drm/sprd: fix potential NULL dereference 'drm' could be null in sprddrmshutdown, and drmwarn maybe dereference it, remove this warning log. v1 - v2: - Split checking platformgetresource return value to a separate patch - Use...

CVE-2022-49208 RDMA/irdma: Prevent some integer underflows

In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Prevent some integer underflows My static checker complains that: drivers/infiniband/hw/irdma/ctrl.c:3605 irdmascceqinit warn: can subtract underflow 'info-dev-hmcfpmmisc.maxceqs'? It appears that...

GHSA-RV66-33HX-33WJ vulnerabilities

Vulnerabilities for packages: mysql...

GHSA-C3G7-X55H-8734 vulnerabilities

Vulnerabilities for packages: mysql...

GHSA-HH3H-F9M4-2347 vulnerabilities

Vulnerabilities for packages: mysql...

GHSA-Q2F4-RPM5-3GXP vulnerabilities

Vulnerabilities for packages: mysql...

GHSA-9M98-937V-R97X vulnerabilities

Vulnerabilities for packages: chromium...

GHSA-QXG5-MCMP-M3M9 vulnerabilities

Vulnerabilities for packages: python...

MAL-2025-1481 Malicious code in gas-oracler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8dcca7c831b2e569f7852c9cacf2c86f95466a0a62c77729ada4b88ace35430d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-6778 · Synology · Synology Active Backup For Business Agent

Name of the Vulnerable Software and Affected Versions: Synology Active Backup for Business affected versions not specified Description: Des vulnérabilités critiques ont été découvertes dans Synology Active Backup for Business, exposant les utilisateurs à des risques d'atteinte à la confidentialit...

SUSE: Security Advisory (SUSE-SU-2023:2146-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CGA-GWP4-6554-5R8X

Bulletin has no description...

CVE-2025-24437 Adobe Commerce | Improper Access Control (CWE-284)

Adobe Commerce versions 2.4.7-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Improper Access Control vulnerability that could result in privilege escalation. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain elevated...

CVE-2025-24437 Adobe Commerce | Incorrect Authorization (CWE-863)

Adobe Commerce versions 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11, 2.4.8-beta1 and earlier are affected by an Incorrect Authorization vulnerability that could result in a security feature bypass. A low-privileged attacker could exploit this vulnerability to view or modify select information...