CVE-2025-1076 Stored Cross-Site Scripting vulnerability in Holded

A Stored Cross-Site Scripting Stored XSS vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality...

CVE-2025-1076 Stored Cross-Site Scripting vulnerability in Holded

A Stored Cross-Site Scripting Stored XSS vulnerability has been found in the Holded application. This vulnerability could allow an attacker to store a JavaScript payload within the editable ‘name’ and ‘icon’ parameters of the Activities functionality...

CVE-2025-1076

CVE-2025-1076 describes a Stored XSS vulnerability in Holded’s application, affecting the editable name and icon fields within the Activities feature. The root cause is storing a JavaScript payload in those parameters, enabling an attacker to inject script via standard input fields. The issue is ...

CVE-2024-30449

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Booking Activities Team Booking Activities allows Reflected XSS.This issue affects Booking Activities: from n/a through 1.15.19...

CVE-2024-32983

Misskey is an open source, decentralized microblogging platform. Misskey doesn't perform proper normalization on the JSON structures of incoming signed ActivityPub activity objects before processing them, allowing threat actors to spoof the contents of signed activities and impersonate the author...

CVE-2024-20874

Improper access control vulnerability in SmartManagerCN prior to SMR Jun-2024 Release 1 allows local attackers to launch privileged activities...

CVE-2024-20888

Improper access control in OneUIHome prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities. User interaction is required for triggering this vulnerability...

CVE-2024-20891

Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities...

MAL-2025-1224 Malicious code in moonpay-widget (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f54359edaa7e13a4f8202996b5622e409f348903724d1243f86b503193bb17c Any computer that has this package installed or running should be considered...

HeartSender Cybercrime Network Dismantled in Joint US-Dutch Operation

Massive Pakistani cybercrime network HeartSender has been shut down in a joint US-Dutch operation. Learn how their phishing…...

Cybercrime gets a few punches on the nose

It’s not often that we get to share good news, so we wanted to grab this opportunity and showcase some progress made by law enforcement actions against cybercrime with you. Europol notified us about the take-down of two of the largest cybercrime forums in the world. With over 10 million users,...

MAL-2025-719 Malicious code in dummy-loosesight-gd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6b81116d25d562a22553f836d8de86b6e893c999b837eab90bafce90180f8dc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-695 Malicious code in types-safety-web (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f87d9fc827765eae4762461f11be747b286e523eca4f28f45a62ab4ff11d3c9 Any computer that has this package installed or running should be considered...

MAL-2025-602 Malicious code in openbet-access-controller (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0dd796ac609bd9ccd763f039c5ecfd7fd63b7c76170f3feaba70a4d2148fa881 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-433 Malicious code in dropbox-payment (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c1844c19c7cf3e5c4516bafe7182ca717bf32d84b8739bbfc011893f4a2e8ce The OpenSSF Package Analysis project identified 'dropbox-payment' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

TRIPLESTRENGTH Hits Cloud for Cryptojacking, On-Premises Systems for Ransomware

Google on Wednesday shed light on a financially motivated threat actor named TRIPLESTRENGTH for its opportunistic targeting of cloud environments for cryptojacking and on-premise ransomware attacks. "This actor engaged in a variety of threat activity, including cryptocurrency mining operations on...

CVE-2024-49737

In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities as the system UID due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

CVE-2024-49737

In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities as the system UID due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

CVE-2024-49737

In applyTaskFragmentOperation of WindowOrganizerController.java, there is a possible way to launch arbitrary activities as the system UID due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need...

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that originates in the WindowOrganizerController.java file's applyTaskFragmentOperation function, which contains a logic error that can be exploited by an...