Malicious code in ossar-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8bf6218656218d743c04b66e989f4f9615fcb7727df4d40cc13d4dc4135a4cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2045 Malicious code in minipay-minidapps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3aa1c34b617bec50d4bb5c5309a8e373ba9a96136b48f20077d41dff0205010 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2046 Malicious code in ossar-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d8bf6218656218d743c04b66e989f4f9615fcb7727df4d40cc13d4dc4135a4cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dependabot-pull-request-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f89f292c4aeef9adcdb74b756e9f23059ca61f0327bfb78956c32e30c9bf3c7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2038 Malicious code in dependabot-pull-request-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f89f292c4aeef9adcdb74b756e9f23059ca61f0327bfb78956c32e30c9bf3c7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1882 Malicious code in lowerlatency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f700dd666f8c638ef80313c4c023741eb86e82499846ae16439704f2136ea28f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1849 Malicious code in init-discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 36972be42f049d52fed075edc83a9547e8c60c890dffcd5fe24b486cf40feea9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1833

A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. Affected by this issue is the function sendNotice of the file src/main/java/com/futvan/z/erp/customernotice/CustomernoticeAction.java of the component HTTP Request Handler. The manipulation of the argumen...

CVE-2025-1831

A vulnerability classified as critical has been found in zj1983 zz up to 2024-8. Affected is the function GetDBUser of the file src/main/java/com/futvan/z/system/zorg/ZorgAction.java. The manipulation of the argument userid leads to sql injection. It is possible to launch the attack remotely. The...

CVE-2025-1818

A vulnerability, which was classified as critical, has been found in zj1983 zz up to 2024-8. This issue affects some unknown processing of the file src/main/java/com/futvan/z/system/zfile/ZfileAction.upload. The manipulation of the argument file leads to unrestricted upload. The attack may be...

CVE-2025-1502

CVE-2025-1502 affects the WordPress plugin IP2Location Redirection (versions up to and including 1.33.3). The issue is a missing capability check on the AJAX action download_ip2location_redirection_backup , allowing unauthenticated attackers to download the plugin’s settings. Public sources in th...

PT-2025-9182 · Unknown · Zorlan Skycaiji

Name of the Vulnerable Software and Affected Versions: Zorlan SkyCaiji version 2.9 Description: A critical vulnerability was found in Zorlan SkyCaiji, affecting the previewAction function of the file vendor/skycaiji/app/admin/controller/Tool.php. The manipulation of the data argument leads to...

MAL-2025-1632 Malicious code in the-integrator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 407040848d5d3bcd09845998a95e5be8dbe90b173fdc0f2ea31185f801ffa84f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1595 Malicious code in golanci-lint-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e69962c9a060f9d61253d944cc7c3573debc57053555bb4dd496618bc1b6510f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in golanci-lint-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e69962c9a060f9d61253d944cc7c3573debc57053555bb4dd496618bc1b6510f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-22271 IP Spoofing in CyberArk Endpoint Privilege Manager

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of...

CVE-2025-22271 IP Spoofing in CyberArk Endpoint Privilege Manager

The application or its infrastructure allows for IP address spoofing by providing its own value in the "X-Forwarded-For" header. Thus, the action logging mechanism in the application loses accountability This issue affects CyberArk Endpoint Privilege Manager in SaaS version 24.7.1. The status of...

Security update for libX11

This update for libX11 fixes the following issues: CVE-2025-26597: improper resizing of key actions when nGroups is 0 can lead to buffer overflows in XkbChangeTypesOfKey bsc1237431. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...

CVE-2025-1662

The URL Media Uploader plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.0 via the 'urlmediauploaderurlupload' action. This makes it possible for authenticated attackers, with author-level access and above, to make web requests to arbitrar...

CVE-2025-1505 Advanced AJAX Product Filters <= 1.6.8.1 - Reflected Cross-Site Scripting

The Advanced AJAX Product Filters plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'nonce' parameter in all versions up to, and including, 1.6.8.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...