14990 matches found
MAL-2025-5541 Malicious code in azure-sentinel (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37e43a68053a45c1fcdea9e752fd9c13f6906e780ab5b8ff5436b3f1b5533d18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2025-27602 · WordPress · The Forminator Forms
Name of the Vulnerable Software and Affected Versions: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress versions up to, and including, 1.44.2 Description: The issue is related to PHP Object Injection via deserialization of untrusted input in the entry...
CVE-2025-53104 gluestack-ui Command Injection Vulnerability via discussion-to-slack GitHub Action Workflow
gluestack-ui is a library of copy-pasteable components & patterns crafted with Tailwind CSS NativeWind. Prior to commit e6b4271, a command injection vulnerability was discovered in the discussion-to-slack.yml GitHub Actions workflow. Untrusted discussion fields title, body, etc. were directly...
CVE-2025-53104
CVE-2025-53104 concerns the gluestack-ui project, where a command injection flaw existed in the discussion-to-slack.yml GitHub Actions workflow. The root cause was untrusted Discussion fields (title/body, etc.) being interpolated directly into shell commands in a run: block, allowing an attacker ...
MAL-2025-5341 Malicious code in sdk.babelhelpz (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 35a386ca07268b83d7deb1496905ac42d5da336255e8beafcdb87d394f34080e Any computer that has this package installed or running should be considered...
WordPress WooCommerce Product Multi-Action plugin <= 1.3 - Deserialization of untrusted data Vulnerability
Deserialization of untrusted data Vulnerability discovered by Phat RiO - BlueRock in WordPress Plugin WooCommerce Product Multi-Action versions = 1.3...
MAL-2025-5515 Malicious code in r6-info.js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d5776f3141e453fa085c2ea81f617610e3243fa733cbd8f54d01864a57e54247 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-5495 Malicious code in dtable-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4325bcefb1ef8dd7bf39cc694fc039f034e9a3811c8af4e36099a9d2bb375318 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
AT&T to pay compensation to data breach victims. Here’s how to check if you were affected
AT&T is set to pay $177 million to customers affected by two significant data breaches. These breaches exposed sensitive personal information of millions of current and former AT&T customers. For those that have missed the story so far: Back in 2021, an entity named Shiny Hunters a known hacking...
MAL-2025-5487 Malicious code in @verrylinh/discord (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4318dae373846eedd4a261b1261f3bd9b820a4a0ce74f9e3adac51d403204428 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Security update for himmelblau
This update for himmelblau fixes the following issues: CVE-2025-5791: Fixed using deprecated users crate bsc1244202 CVE-2025-3416: Fixed use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate bsc1242648 Update to version 0.7.17+git.0.1ebdab0 Update sccache-action version to use new...
Malicious code in action_dropdown (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fa59d258b8e3e32c53b3c209203176ea50eabf29b16767fe69cb055147503799 Any computer that has this package installed or running should be considered...
CVE-2025-36027
IBM Datacap 9.1.7, 9.1.8, and 9.1.9 could allow a remote attacker to hijack the clicking action of the victim. By persuading a victim to visit a malicious Web site, a remote attacker could exploit this vulnerability to hijack the victim's click actions and possibly launch further attacks against...
MAL-2025-5448 Malicious code in online-learning-ui (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 853a4095a2f08a67260f3c2220bc45ef9484b10db0a4f909560bf36485cb54cf Any computer that has this package installed or running should be considered...
COVID19 Testing Management System Take Action Component Cross-Site Scripting Vulnerability
COVID19 Testing Management System is a new crown pneumonia testing management system. COVID19 Testing Management System suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the parameter mark in the file...
MAL-2025-5479 Malicious code in webengage (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b526ee0b000536b84421cac42f7eaa62010d08785c0d61238fe4c3afe8a445d Any computer that has this package installed or running should be considered...
MGASA-2025-0192 Updated apache-mod_security packages fix security vulnerabilities
ModSecurity Has Possible DoS Vulnerability. CVE-2025-47947 ModSecurity has possible DoS vulnerability in sanitiseArg action. CVE-2025-48866...
Perry: a High-Level Framework for Accelerating Cyber Deception Experimentation
Cyber deception aims to distract, delay, and detect network attackers with fake assets such as honeypots, decoy credentials, or decoy files. However, today, it is difficult for operators to experiment, explore, and evaluate deception approaches. Existing tools and platforms have non-portable and...
VulnCheck KEV: CVE-2019-17574
An issue was discovered in the Popup Maker plugin before 1.8.13 for WordPress. An unauthenticated attacker can partially control the arguments of the doaction function to invoke certain popmake or pum methods, as demonstrated by controlling content and delivery of popmake-system-info.txt...
70mai 1S 安全漏洞
70mai 1S is a smart recorder from 70mai 70mai, a Chinese company. A security vulnerability exists in 70mai 1S 20250611 and earlier versions, which stems from improper authorization due to misuse of the file /cgi-bin/Config.cgi?action=set...