CVE-2025-0442

Inappropriate implementation in Payments in Google Chrome prior to 132.0.6834.83 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

CVE-2025-0435

Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

CVE-2025-0435

Google Chrome on Android (Navigation component) is affected by CVE-2025-0435 due to an inappropriate implementation that enables UI spoofing via a crafted HTML page. The issue affects versions prior to 132.0.6834.83. The practical impact is remote UI spoofing without user privileges. Remediation ...

CVE-2025-0435

Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

CVE-2025-0435

Inappropriate implementation in Navigation in Google Chrome on Android prior to 132.0.6834.83 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: High...

MAL-2025-124 Malicious code in venmo-ui (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c56cfa4b6e6b329cc9502a5eeea242d13fd03e156392465657d5254b441ecfe Any computer that has this package install...

Malicious code in venmo-ui (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c56cfa4b6e6b329cc9502a5eeea242d13fd03e156392465657d5254b441ecfe Any computer that has this package install...

SUSE CVE-2025-22445

Mattermost versions 10.x = 10.2 fail to accurately reflect missing settings, which allows confusion for admins regarding a Calls security-sensitive configuration via incorrect UI reporting...

CVE-2024-41454

CVE-2024-41454 : The reports indicate an arbitrary file upload vulnerability in the Process Maker pm4core-docker 4.1.21-RC7 UI login page logo upload function. A crafted PHP or HTML file can be uploaded, enabling arbitrary code execution. The exact root cause described is an insecure file upload ...

GHSA-2V2W-8V8C-WCM9 Rancher UI has Stored Cross-site Scripting vulnerability

Impact A vulnerability has been identified within Rancher UI that allows a malicious actor to perform a Stored XSS attack through the cluster description field. Please consult the associated MITRE ATT&CK - Technique - Drive-by Compromise for further information about this category of attack...

Rancher UI has Stored Cross-site Scripting vulnerability

Impact A vulnerability has been identified within Rancher UI that allows a malicious actor to perform a Stored XSS attack through the cluster description field. Please consult the associated MITRE ATT&CK - Technique - Drive-by Compromise for further information about this category of attack...

Incorrect UI Reporting

github.com/mattermost/mattermost-server is vulnerable to Incorrect UI reporting. The vulnerability is due to inaccurate reporting of missing settings, which allows an attacker to exploit misconfigurations. This could lead to manipulation of the Calls feature or unauthorized access to sensitive da...

PT-2025-1285 · Microsoft +5 · Edge +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.83 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in Compositing, allowing a remote attacker to perform UI spoofing via a crafted...

PT-2025-1280 · Microsoft +5 · Edge +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.83 Microsoft Edge versions affected versions not specified Description: The issue is related to a race condition in the Frames component of Google Chrome and Microsoft Edge, allowing a remote attacke...

PT-2025-1281 · Google +2 · Google Chrome +2

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.83 Description: The issue is related to an inappropriate implementation in Fullscreen mode, allowing a remote attacker to perform UI spoofing via a crafted HTML page. This could enable the attacker t...

PT-2025-1264 · Microsoft +3 · Edge +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.83 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Navigation function of Google Chrome and Microsoft Edge, allowing a remot...

PT-2025-1287 · Microsoft +5 · Edge +5

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 132.0.6834.83 Microsoft Edge affected versions not specified Description: The issue is related to an inappropriate implementation in the Extensions component of Google Chrome and Microsoft Edge, allowing a remo...

Malicious code in jiolocate-ui (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 632763242c2df9c72854a919e8fd6a0c7a8b6debedb9c7e22cbd886883c4217b Any computer that has this package install...

CVE-2024-49785

IBM watsonx.ai 1.1 through 2.0.3 and IBM watsonx.ai on Cloud Pak for Data 4.8 through 5.0.3 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2025-22445

CVE-2025-22445 affects Mattermost Server in the 10.x line up to 10.2 where the UI incorrectly reflects missing admin settings for the Calls feature, causing admin confusion. SUSE advisory SUSE-SU-2025:0297-1 documents the issue and recommends updating to OpenSUSE/Mattermost patch level 10.3 or la...