PT-2025-32009 · Unknown +1 · Security-Kit +1

Name of the Vulnerable Software and Affected Versions: Vision UI versions 1.4.0 and below Description: The generateSecureId and getSecureRandomInt functions within the security-kit component versions prior to 3.5.0, packaged in Vision UI 1.4.0 and below are susceptible to Denial of Service DoS...

Malicious code in zano_ui (npm)

The package communicates with a domain associated with malicious activity...

Swagger UI 1.0.3 - Cross-Site Scripting (XSS)

/ Author : Byte Reaper Telegram : @ByteReaper0 CVE : CVE-2025-8191 Title : Swagger UI 1.0.3 - Cross-Site Scripting XSS Description : CVE-2025-8191, a vulnerability in the Swagger UI service due to poor description parameter filtering, leading to command execution on a remote server. / include...

Malicious code in xo-angular-ui-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c1ba74b83fb3a51e171948d55aa626342a1477d24f1f0f768f093cba5feef7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6679 Malicious code in xo-angular-ui-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c1ba74b83fb3a51e171948d55aa626342a1477d24f1f0f768f093cba5feef7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-54133

Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP Model Context Protocol deeplink handler, allowing attackers to execute 2-click arbitrary system commands through social engineering attacks. When...

CVE-2025-54133 Cursor's MCP Install Deeplink Does Not Show Arguments in its User-Dialog

Cursor is a code editor built for programming with AI. In versions 1.17 through 1.2, there is a UI information disclosure vulnerability in Cursor's MCP Model Context Protocol deeplink handler, allowing attackers to execute 2-click arbitrary system commands through social engineering attacks. When...

CVE-2025-33118

IBM QRadar SIEM 7.5 through 7.5.0 Update Pack 12 is vulnerable to stored cross-site scripting. This vulnerability allows authenticated users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted...

Malicious code in walmart-ui (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6668 Malicious code in walmart-ui (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-6656 Malicious code in simple-auth-manager-ui (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in e-voting-libraries-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b61daa9fe3e3708d3d8fb85252df936d46de90bf87b463f270618bf8769aba02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-7C78-RM87-5673 MS SWIFT WEB-UI RCE Vulnerability

I. Detailed Description: This includes scenarios, screenshots, vulnerability reproduction methods. For account-related vulnerabilities, please provide test accounts. If the reproduction process is complex, you may record a video, upload it to Taopan, and attach the link. 1. Install ms-swift pip...

Devolutions Server <= 2025.2.4.0 UI Discrepancy for Security Feature (DEVO-2025-0013) (CVE-2025-8353)

The version of Devolutions Server installed on the remote host is prior or equal to 2025.2.4.0 and is, therefore, affected by a UI discrepancy for security feature vulnerability: - UI synchronization issue in the Just-in-Time JIT access request approval interface in Devolutions Server 2025.2.4.0...

SUSE CVE-2022-31160

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents...

MAL-2025-6736 Malicious code in mpesa-ui-components (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in mpesa-ui-components (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-8353

UI synchronization issue in the Just-in-Time JIT access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing...

CVE-2025-8353

UI synchronization issue in the Just-in-Time JIT access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing...

CVE-2025-8353

UI synchronization issue in the Just-in-Time JIT access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing...