CVE-2025-59363

In One Identity OneLogin prior to 2025.3.0, the GET /api/2/apps endpoint returned OIDC client_secret values alongside app metadata, enabling disclosure of sensitive credentials. This is caused by excessive data being returned by the Apps API v2 and constitutes a breach of confidentiality for OIDC...

Vulnerability of Microsoft Office packages, 365 Apps for Enterprise, and Microsoft PowerPoint presentation preparation programs, related to memory usage after its release, allowing attackers to execute arbitrary code.

Vulnerabilities of Microsoft Office packages, 365 Apps for Enterprise, and Microsoft PowerPoint presentation software are related to the use of memory after it is released. Exploiting these vulnerabilities can allow attackers to execute arbitrary code...

CVE-2025-59363: Incorrect Resource Transfer Between Spheres

In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 even though this secret should only be returned when an App is first created,...

Malicious Package

Overview polkadot-apps is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2025-47100 Malicious code in polkadot-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59092b31b08f13b01c42d1e03ec24bdaf044459cc73c90f1ac4c458dbb5817a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polkadot-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59092b31b08f13b01c42d1e03ec24bdaf044459cc73c90f1ac4c458dbb5817a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in polkadot-apps

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

What You Code Is What We Prove: Translating BLE App Logic into Formal Models with LLMs for Vulnerability Detection

The application layer of Bluetooth Low Energy BLE is a growing source of security vulnerabilities, as developers often neglect to implement critical protections such as encryption, authentication, and freshness. While formal verification offers a principled way to check these properties, the manu...

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages relates to the execution of operations beyond buffer boundaries in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the execution of operations beyond the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of Microsoft Office and 365 Apps for Enterprise applications relates to the execution of operations beyond the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the execution of operations outside the buffer in memory. Exploiting this vulnerability allows an attacker to execute arbitrary code...

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages lies in the exploitation of previously unutilized memory, allowing an attacker to execute arbitrary code.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise lies in the exploitation of previously unutilized memory. Exploiting this vulnerability can allow an attacker to execute arbitrary code...

The vulnerability of Microsoft Office and 365 Apps for Enterprise packages relates to the execution of operations beyond the buffer in memory, allowing attackers to disclose protected information.

The vulnerability of Microsoft Office packages and 365 Apps for Enterprise is related to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose protected information...

EvilAI Operators Use AI-Generated Code and Fake Apps for Far-Reaching Attacks

Combining AI-generated code and social engineering, EvilAI operators are executing a rapidly expanding campaign, disguising their malware as legitimate applications to bypass security, steal credentials, and persistently compromise organizations worldwide...

CVE-2025-58752

A path traversal / static-file serving bypass vulnerability has been identified in Vite’s static file server, where HTML files located outside the configured root or deny/allow lists may be served even when server.fs settings such as deny are used. An attacker can exploit this by requesting HTML...

CVE-2025-10213

DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a dxtn.dll file of their choice in the 'C:\Users\AppData\Local\Microsoft\WindowsApps' directory, which could lead to arbitrary...

CVE-2025-10213 DLL search path hijacking vulnerability

DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a dxtn.dll file of their choice in the 'C:\Users\AppData\Local\Microsoft\WindowsApps' directory, which could lead to arbitrary...

CVE-2025-10213

CVE-2025-10213 is a DLL search path hijacking vulnerability affecting UPDF.exe on Windows (version 1.8.5.0). An attacker with local access can cause arbitrary code execution and persistence by placing a crafted dxtn.dll in the path C:\Users\AppData\Local\Microsoft\WindowsApps, exploiting the Wind...

PT-2025-37033

Name of the Vulnerable Software and Affected Versions: UPDF version 1.8.5.0 Description: A DLL search path hijacking issue exists in the UPDF.exe executable for Windows. An attacker with local access can execute arbitrary code by placing a malicious dxtn.dll file in the...

Linux Distros Unpatched Vulnerability : CVE-2016-2487

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows attackers to gain privileges...

GHSA-JQFW-VQ24-V9C3 Vite's `server.fs` settings were not applied to HTML files

Summary Any HTML files on the machine were served regardless of the server.fs settings. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - appType: 'spa' default or appType: 'mpa' i...