MAL-2025-2080 Malicious code in @roku-web-ui/legacy-nav-page-standard-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c0fda134ffeb40092f3455e93def754a1f268e9e072daf6c275e9c40b35b1917 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-25967

Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery CSRF. This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections...

CVE-2024-30154

HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2024-30154

HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2024-30154 HCL SX is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability

HCL SX is vulnerable to cross-site request forgery vulnerability which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts...

CVE-2024-30154

CVE-2024-30154 is described across multiple sources as a Cross-Site Request Forgery vulnerability in HCL SX. The connected documents confirm the affected product (HCL SX) and the CSRF nature, with impact statements indicating potential unauthorized actions and high integrity impact, but they do n...

Security Bulletin: IBM Engineering Requirements Management DOORS Next is vulnerable to Information Exposure Through Error Message (CVE-2024-39725)

Summary IBM Engineering Requirements Management DOORS Next is vulnerable to Information Exposure Through Error Message CVE-2024-39725. Vulnerability Details CVEID:CVE-2024-39725 DESCRIPTION: IBM Engineering Lifecycle Optimization - Engineering Insights 7.0.2 and 7.0.3 could allow a remote attacke...

PT-2025-9530

Name of the Vulnerable Software and Affected Versions HCL SX affected versions not specified Description The issue allows an attacker to execute malicious and unauthorized actions by exploiting a cross-site request forgery vulnerability, taking advantage of the trust the website has in a user...

CVE-2025-25967

Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery CSRF. This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections...

CVE-2025-25967

Acora CMS version 10.1.1 is vulnerable to Cross-Site Request Forgery CSRF. This flaw enables attackers to trick authenticated users into performing unauthorized actions, such as account deletion or user creation, by embedding malicious requests in external content. The lack of CSRF protections...

CVE-2025-25967

CVE-2025-25967 affects Acora CMS 10.1.1, where a Cross-Site Request Forgery (CSRF) vulnerability allows an attacker to trick authenticated users into performing unauthorized actions by embedding malicious requests in external content. The lack of CSRF protections is the root cause. According to t...

CVE-2025-1755

MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in C:\nodemodules\. This issue affects MongoDB Compass prior to 1.42.1...

CVE-2025-1693

The MongoDB Shell may be susceptible to control character injection where an attacker with control over the database cluster contents can inject control characters into the shell output. This may result in the display of falsified messages that appear to originate from mongosh or the underlying...

Security update for libX11

This update for libX11 fixes the following issues: CVE-2025-26597: improper resizing of key actions when nGroups is 0 can lead to buffer overflows in XkbChangeTypesOfKey bsc1237431. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdat...

MAL-2025-1582 Malicious code in ethereum-producer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ad34d841dff398c9fc38a86363950e59b3c5a6a3af2fb02d596472a11878d11 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site Scripting (XSS)

Overview opencart/opencart is a shopping cart system Affected versions of this package are vulnerable to Cross-site Scripting XSS via the /product/search endpoint. An attacker can execute arbitrary JavaScript in the victim's browser and potentially access sensitive information or perform actions ...

CVE-2025-1746 Cross-Site Scripting vulnerability in OpenCart

Cross-Site Scripting vulnerability in OpenCart versions prior to 4.1.0. This vulnerability allows an attacker to execute JavaScript code in the victim's browser by sending the victim a malicious URL using the search in the /product/search endpoint. This vulnerability could be exploited to steal...

ESRI ArcGIS AllSource Untrusted Search Path Vulnerability

ESRI ArcGIS AllSource is a Intelligence Analyzer software developed by ESRI. An untrustworthy search path vulnerability exists in ESRI ArcGIS AllSource, which can be exploited by an attacker to execute malicious commands...

Security Bulletin: IBM MQ Appliance is affected by multiple Java vulnerabilities (CVE-2024-10197, CVE-2024-21208 and CVE-2024-21217)

Summary IBM MQ Appliance has addressed multiple Java vulnerabilities. Vulnerability Details CVEID:CVE-2024-21217 DESCRIPTION: Vulnerability in Java SE component: Serialization. Difficult to exploit vulnerability allows unauthenticated attacker with network access via multiple protocols to...

GHSA-F5W3-73H4-JPCM mongosh vulnerable to local privilege escalation

mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\nodemodules. This issue affects mongosh prior to 2.3.0...