CVE-2025-36132

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur...

CVE-2025-36262

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input...

CVE-2025-36262 IBM Planning Analytics Local information disclosure

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input...

CVE-2025-36262 IBM Planning Analytics Local information disclosure

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 could allow a malicious privileged user to bypass the UI to gain unauthorized access to sensitive information due to the improper validation of input...

CVE-2025-36262

IBM Planning Analytics Local is affected in versions 2.0.0–2.0.106 and 2.1.0–2.1.13. The issue is due to improper input validation that could allow a malicious privileged user to bypass the UI and access sensitive information. No exploit details are provided in the documents. Remediation is to up...

CVE-2025-36132

CVE-2025-36132 affects IBM Planning Analytics Local (IBM Planning Analytics Workspace) with versions 2.0.0–2.0.106 and 2.1.0–2.1.13. A cross-site scripting vulnerability allows an authenticated user to inject arbitrary JavaScript into the Web UI, potentially altering functionality and leading to ...

CVE-2025-36132 IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur...

CVE-2025-36132 IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosur...

PT-2025-40023

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local versions 2.0.0 through 2.0.106 IBM Planning Analytics Local versions 2.1.0 through 2.1.13 Description A malicious privileged user may be able to bypass the user interface to obtain unauthorized access to sensitive...

PT-2025-40022

Name of the Vulnerable Software and Affected Versions IBM Planning Analytics Local versions 2.0.0 through 2.0.106 IBM Planning Analytics Local versions 2.1.0 through 2.1.13 Description An authenticated user can embed arbitrary JavaScript code in the Web UI, potentially altering intended...

IBM Planning Analytics Local 安全漏洞

IBM Planning Analytics Local is a web-based local architecture from International Business Machines IBM. A security vulnerability exists in IBM Planning Analytics Local versions 2.0.0 through 2.0.106 and 2.1.0 through 2.1.13, which stems from improper input validation and could result in...

MAL-2025-47822 Malicious code in phoenix-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94bc35faad75f63d0ebbb6a00e345d0bcb96e35e820f9129640db9dba220627c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in phoenix-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94bc35faad75f63d0ebbb6a00e345d0bcb96e35e820f9129640db9dba220627c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-9816

The WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the User-Agent Header in all versions up to, and including, 14.5.4 due to insufficient input sanitization and output escaping. This makes it possible for...

MAL-2025-47857 Malicious code in pc-analytics-promotion-creation-core (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9292e3bed279b8b99bcdac22deaa003418229efa19faeb2633583bc389307242 Any computer that has this package installed or running should be considered...

H2O Flow Unauthenticated Access

H2O Flow is an open-source user interface for H2O, an open-source, distributed and scalable machine learning and predictive analytics platform. By default, H2O Flow does not require authentication to access the application. This allows an attacker to access sensitive data. This detection is...

CVE-2025-20364

A vulnerability in the Device Analytics action frame processing of Cisco Wireless Access Point AP Software could allow an unauthenticated, adjacent attacker to inject wireless 802.11 action frames with arbitrary information. This vulnerability is due to insufficient verification checks of incomin...

TikTok is misusing kids’ data, says privacy watchdog

A group of privacy commissioners in Canada have accused TikTok of scooping up information about hundreds of thousands of children who shouldn't have been on the platform. The Chinese social media giant is also accused of collecting data on Canadian users without properly explaining what it does...

When AD Gets Breached: Detecting NTDS.dit Dumps and Exfiltration with Trellix NDR

When AD Gets Breached: Detecting NTDS.dit Dumps and Exfiltration with Trellix NDR By Maulik Maheta · September 25, 2025 Executive summary Active Directory AD stores the digital keys to an organization's kingdom. When attackers gain access to a network, they often target the NTDS.dit file, which...

CVE-2025-57935

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Ricky Dawn Bot Block - Stop Spam Referrals in Google Analytics bot-block-stop-spam-google-analytics-referrals allows Stored XSS.This issue affects Bot Block - Stop Spam Referrals in Google Analytic...