PT-2025-1245 · Microsoft · Office Excel +2

Name of the Vulnerable Software and Affected Versions: Microsoft Excel affected versions not specified Description: The issue is related to a remote code execution problem in Microsoft Excel. It is associated with the dereferencing of an untrusted pointer in Microsoft Office and 365 Apps for...

PT-2025-1270 · Microsoft · 365 Apps For Enterprise +2

Name of the Vulnerable Software and Affected Versions: Microsoft Access affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to a buffer overflow in dynamic memory, which can be exploited to execute arbitrary code. Thi...

Microsoft Outlook security vulnerabilities

Microsoft Outlook is a suite of e-mail applications from Microsoft Corporation USA. A security vulnerability exists in Microsoft Outlook. An attacker exploiting this vulnerability could remotely execute code. The following products and editions are affected:Microsoft Office 2019 for 32-bit...

PT-2025-1241

Name of the Vulnerable Software and Affected Versions Microsoft Word affected versions not specified Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description The issue is related to a remote code execution problem in Microsoft...

CVE-2025-23027

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

CVE-2025-23027: Cleartext Storage of Sensitive Information

next-forge is a Next.js project boilerplate for modern web application. The BASEHUBTOKEN commited in apps/web/.env.example. Users should avoid use of this token and should remove any access it may have in their systems...

Apps That Are Spying on Your Location

404 Media and Wired are reporting on all the apps that are spying on your location, based on a hack of the location data company Gravy Analytics: The thousands of apps, included in hacked files from location data company Gravy Analytics, include everything from games like Candy Crush to dating ap...

CVE-2024-12402

CVE-2024-12402 impacts the Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress. The root cause is insecure direct object reference: the plugin does not properly validate a user’s identity before password updates in update_user_profile(), enabling unauthenticate...

CVE-2024-12402: Authentication Bypass Using an Alternate Path or Channel

The Themes Coder – Create Android & iOS Apps For Your Woocommerce Site plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.4. This is due to the plugin not properly validating a user's identity prior to updating their password...

CVE-2025-21615 AAT allows data exfiltration by other apps installed on the same device

AAT Another Activity Tracker is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device...

CVE-2025-21615 AAT allows data exfiltration by other apps installed on the same device

AAT Another Activity Tracker is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device...

CVE-2025-21615 AAT allows data exfiltration by other apps installed on the same device

AAT Another Activity Tracker is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device...

CVE-2025-21615

CVE-2025-21615 affects AAT (Another Activity Tracker) for mobile: versions prior to 1.26 are vulnerable to data exfiltration by other apps installed on the same device. The root cause is data disclosure leakage from the app’s environment, leading to potential confidentiality impact described as h...

CVE-2024-11849

creationtimestamp| type| source ---|---|--- 2025-01-06 06:03:26+00:00| seen| https://infosec.exchange/users/cve/statuses/113779894266060216 2025-01-06 06:15:30+00:00| seen| https://bsky.app/profile/cve-notifications.bsky.social/post/3lf2ib3s42j2k 2025-01-06 06:40:36+00:00| seen|...

PT-2025-4301 · Aat · Aat

Name of the Vulnerable Software and Affected Versions: AAT Another Activity Tracker versions prior to 1.26 Description: AAT is a GPS-tracking application for tracking sportive activities, with an emphasis on cycling. The issue allows for data exfiltration from malicious apps installed on the same...

CVE-2025-21615: Exposure of Sensitive Information to an Unauthorized Actor

AAT Another Activity Tracker is a GPS-tracking application for tracking sportive activities, with emphasis on cycling. Versions lower than v1.26 of AAT are vulnerable to data exfiltration from malicious apps installed on the same device...

PLAYFULGHOST Delivered via Phishing and SEO Poisoning in Trojanized VPN Apps

Cybersecurity researchers have flagged a new malware called PLAYFULGHOST that comes with a wide range of information-gathering features like keylogging, screen capture, audio capture, remote shell, and file transfer/execution. The backdoor, according to Google's Mandiant Managed Defense team,...

Karmada security vulnerabilities

Karmada is a Kubernete management system open-sourced by Karmada. A security vulnerability exists in Karmada versions prior to 1.12.0 that stems from allowing users to run cloud-native applications across multiple Kubernetes clusters and clouds...

Severe Security Flaws Patched in Microsoft Dynamics 365 and Power Apps Web API

Details have emerged about three now-patched security vulnerabilities in Dynamics 365 and Power Apps Web API that could result in data exposure. The flaws, discovered by Melbourne-based cybersecurity company Stratus Security, have been addressed as of May 2024. Two of the three shortcomings resid...

Malicious code in safe-apps-react-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4844f797621f2cd62b20851643278b7d27cfc2ca46fdd1485383cd7818d5c0a8 Any computer that has this package install...