Malicious code in fluro-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c04c138df7be76776b255750944cf66472503de25abd93507c7ab4d8edf33c58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting (XSS)

Overview org.wso2.carbon.identity.framework:org.wso2.carbon.identity.user.store.configuration.ui is an User Store UI component for WSO2 Carbon Affected versions of this package are vulnerable to Cross-site Scripting XSS due to insufficient output encoding in error messages generated by the JDBC...

WSO2 products vulnerable to Cross-site Scripting

A reflected cross-site scripting XSS vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser ...

CVE-2024-8008 Reflected Cross-Site Scripting (XSS) in Multiple WSO2 Products via JDBC User Store Connection Validation

A reflected cross-site scripting XSS vulnerability exists in multiple WSO2 products due to insufficient output encoding in error messages generated by the JDBC user store connection validation request. A malicious actor can inject a specially crafted payload into the request, causing the browser ...

CVE-2025-2896

IBM Planning Analytics Local (versions 2.0 and 2.1) is affected by a cross-site scripting vulnerability in the Web UI that an authenticated user can exploit to inject arbitrary JavaScript, potentially leaking credentials within a trusted session. Affected products/versions: IBM Planning Analytics...

CVE-2025-2896 IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-25044

CVE-2025-25044 affects IBM Planning Analytics Local (2.0 and 2.1). The vulnerability is cross-site scripting in the Web UI that allows an authenticated user to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected products are IBM Planning An...

CVE-2025-25044 IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

Malicious code in @majidalfuttaim/maf-ui (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2330446b43c4350ffd756e057399577c16b5b7b20767a3a71fc73b20664fe62 Any computer that has this package installed or running should be considered...

PT-2025-23423 · Ibm · Ibm Planning Analytics Local

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics Local versions 2.0 through 2.1 Description: The issue allows an authenticated user to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...

CVE-2025-5066

Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-5067

Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2025-5065

Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2025-5065

Inappropriate implementation in FileSystemAccess API in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2025-5066

Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2025-5067

Inappropriate implementation in Tab Strip in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

Microsoft Edge (Chromium) < 137.0.3296.52 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 137.0.3296.52. It is, therefore, affected by multiple vulnerabilities as referenced in the May 29, 2025 advisory. - Out of bounds write in V8 in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to...

Cross-site Scripting (XSS)

Overview github.com/argoproj/argo-cd/v2/ui is a declarative, GitOps continuous delivery tool for Kubernetes. Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper filtering of repository URLs in the UI. An attacker can execute unauthorized API actions via th...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS due to improper filtering of repository URLs in the UI. An attacker can execute unauthorized API actions via the victim's session by injecting malicious JavaScript through crafted links. Details Cross-site...

CVE-2024-45094

CVE-2024-45094 affects IBM DS8900F and DS8A00 Hardware Management Console (HMC): stored cross-site scripting in the Web UI could let a privileged user inject arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. IBM notes remediation via firmware/microcode u...