GHSA-9M5P-C77C-F9J7 vulnerabilities

Vulnerabilities for packages: hubble-ui, hubble-ui-backend-fips...

CVE-2025-23047 Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who...

CVE-2025-23047 Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who...

CVE-2025-23047

CVE-2025-23047 affects Cilium with Hubble UI when deployed; insecure default Access-Control-Allow-Origin header can expose cluster configuration. Affected: 1.14.0–1.14.7, 1.15.0–1.15.11, 1.16.0–1.16.4. Exploit requires visiting a malicious page; could reveal Kubernetes cluster details (node names...

CVE-2025-23047 Cilium vulnerable to information leakage via insecure default Hubble UI CORS header

Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default Access-Control-Allow-Origin header value could lead to sensitive data exposure for users of Cilium versions 1.14.0 through 1.14.7, 1.15.0 through 1.15.11, and 1.16.0 through 1.16.4 who...

CVE-2025-23028 vulnerabilities

Vulnerabilities for packages: hubble-ui, hubble-ui-backend-fips...

CVE-2025-23028 vulnerabilities

Vulnerabilities for packages: hubble-ui...

PT-2025-4791 · Cilium +1 · Cilium +1

Name of the Vulnerable Software and Affected Versions: Cilium versions 1.14.0 through 1.14.7 Cilium versions 1.15.0 through 1.15.11 Cilium versions 1.16.0 through 1.16.4 Description: Cilium is a networking, observability, and security solution with an eBPF-based dataplane. An insecure default...

CVE-2024-45478

Stored XSS vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue...

CVE-2024-45479 Apache Ranger: SSRF in Edit Service page - Add logic to filter requests to localhost

SSRF vulnerability in Edit Service Page of Apache Ranger UI in Apache Ranger Version 2.4.0. Users are recommended to upgrade to version Apache Ranger 2.5.0, which fixes this issue...

Malicious code in ui-components-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5ebed80f557fd2e81a446cf38988b615c07e4459d17b289756a2646e2b8fd54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-316 Malicious code in ui-components-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5ebed80f557fd2e81a446cf38988b615c07e4459d17b289756a2646e2b8fd54 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-components-highlight-vdom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 17c058680e21b489b3504441b59346650d2d8f204795eda46ba03d8c9585e58f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in smaato-shared-ui-audience-targeting (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1fb6a2756f6c261829cb9bf265de88beb6c5b8a696325f5ffb0ae37c5acf0fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft Edge (Chromium) < 132.0.2957.115 Multiple Vulnerabilities

The version of Microsoft Edge installed on the remote Windows host is prior to 132.0.2957.115. It is, therefore, affected by multiple vulnerabilities as referenced in the January 14, 2025 advisory. - Out of bounds read in Metrics in Google Chrome prior to 132.0.6834.83 allowed a remote attacker t...

CVE-2024-41746 IBM CICS TX cross-site scripting

IBM CICS TX Advanced 10.1, 11.1, and Standard 11.1 is vulnerable to stored cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

SUSE CVE-2025-0435

Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

SUSE CVE-2025-0439

Race in Frames in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2025-0443

Insufficient data validation in Extensions in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform privilege escalation via a crafted HTML page. Chromium security severity: Medium...

SUSE CVE-2025-0448

Inappropriate implementation in Compositing in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...