PT-2025-2952 · Discourse · Discourse

Name of the Vulnerable Software and Affected Versions: Discourse versions prior to the latest version of Discourse core Description: Discourse is an open source platform for community discussion. In affected versions with some combinations of plugins, and with CSP disabled, activity streams in th...

WordPress plugin Activity Log WinterLock 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site request forgery vulnerability exists ...

Discourse 跨站脚本漏洞

Discourse is an open source community discussion platform from Discourse Open Source. The platform includes community, email, and chat room features. Discourse suffers from a cross-site scripting vulnerability that stems from the fact that the activity stream in a user's profile page may be...

JVN#94806805: WordPress Plugin "Activity Log WinterLock" vulnerable to cross-site request forgery

WordPress Plugin "Activity Log WinterLock" provided by SWIT contains a cross-site request forgery vulnerability CWE-352. Impact If a user views a malicious page while logged in, the log data may be deleted. Solution Update the plugin Update the plugin according to the information provided by the...

CVE-2025-22918

creationtimestamp| type| source ---|---|--- 2025-02-03 21:15:53+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lhchmvhxug2f 2025-02-03 22:08:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lhckkqqmmb2g 2025-02-03 23:41:03+00:00| seen|...

Malicious code in effect-layout-function (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-1037 Malicious code in guests (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 90c450f222886a91d7c733fcfbdf4a4b5104c0b4a1d1931f79e0bea1201f1398 Any computer that has this package installed or running should be considered...

MAL-2025-1228 Malicious code in precompiled-iris300 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2fc49c5f492a6603e16701144ee66fabcdea41176b445eb496c8e9d11caccd4 Any computer that has this package installed or running should be considered...

Malicious code in cth-poc (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in cg-be-package (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-1031 Malicious code in cg-be-package (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in invalid-dependency (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-1212 Malicious code in cth-poc (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in fitbit-widget-dropdown (npm)

The package communicates with a domain associated with malicious activity...

MAL-2025-1013 Malicious code in apple-sdk (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4113cf662e414936dfc540b2ebc7c134b8d83e46635daadf59a0105f86c70feb Any computer that has this package installed or running should be considered...

CERTFR-2025-ACT-005

creationtimestamp| type| source ---|---|--- 2025-02-03 16:13:24+00:00| seen| https://bsky.app/profile/infosecfr.skyfleet.blue/post/3lhbwpyxgkh2e 2025-02-03 16:15:16+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/113940844708523152 2025-02-03 16:15:16+00:00| seen|...

PT-2025-2450 · Enflick · Textnow

Name of the Vulnerable Software and Affected Versions: TextNow: Call + Text Unlimited version 24.17.0.2 Description: The issue allows any installed application, without requiring permissions, to place phone calls without user interaction. This is achieved by sending a crafted intent via the...

ASB-A-305695605

In multiple locations, there is a possible way to launch an activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

ASB-A-352542820

In onCreateOptionsMenu of UserSettings.java, there is a possible way to remove the work profile by opening a hidden activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

ASB-A-354682735

In InputMethodSubtypeArray of InputMethodSubtypeArray.java, there is a possible way to bypass a key intent check to launch arbitrary activity due to Parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...