Malicious code in iberia-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bd29cd417b8dec54243dc5adc05798a3265ed0ecab1ca348793ac0b61d885e23 The OpenSSF Package Analysis project identified 'iberia-auth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Malicious code in godaddy-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c54464c94638aea7ef7fe1487d3fca93fd814ea21143ed03917174262afebe99 The OpenSSF Package Analysis project identified 'godaddy-auth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-459 Malicious code in godaddy-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c54464c94638aea7ef7fe1487d3fca93fd814ea21143ed03917174262afebe99 The OpenSSF Package Analysis project identified 'godaddy-auth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-397 Malicious code in bookingcom-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7237784b36f09a01626b97a404f66a5ec889f55f623dd7d6e907f48d2b99d69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in amazon-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 972d775baca466f5fa482d2629c80172c236ea0f349612f1e9e9aa9f00919807 The OpenSSF Package Analysis project identified 'amazon-auth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-371 Malicious code in amazon-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 972d775baca466f5fa482d2629c80172c236ea0f349612f1e9e9aa9f00919807 The OpenSSF Package Analysis project identified 'amazon-auth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

Important: tomcat10

Issue Overview: Time-of-check Time-of-use TOCTOU Race Condition vulnerability during JSP compilation in Apache Tomcat permits an RCE on case insensitive file systems when the default servlet is enabled for write non-default configuration. This issue affects Apache Tomcat: from 11.0.0-M1 through...

Malicious code in airbnb-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 569af68d5b2f70cc46c62d3be362723205c02819f13c60a456a6925c2f6d1dd2 The OpenSSF Package Analysis project identified 'airbnb-auth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2025-357 Malicious code in airbnb-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 569af68d5b2f70cc46c62d3be362723205c02819f13c60a456a6925c2f6d1dd2 The OpenSSF Package Analysis project identified 'airbnb-auth' @ 999.9.9 npm as malicious. It is considered malicious because: - The package...

CVE-2025-23506

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in imsoftware WP IMAP Auth wp-imap-authentication allows Reflected XSS.This issue affects WP IMAP Auth: from n/a through = 4.0.1...

CVE-2025-23506 WordPress WP IMAP Auth plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in imsoftware WP IMAP Auth wp-imap-authentication allows Reflected XSS.This issue affects WP IMAP Auth: from n/a through = 4.0.1...

CVE-2025-23506 WordPress WP IMAP Auth plugin <= 4.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in imsoftware WP IMAP Auth wp-imap-authentication allows Reflected XSS.This issue affects WP IMAP Auth: from n/a through = 4.0.1...

CVE-2025-23506

CVE-2025-23506 is a Reflected XSS in the WP IMAP Auth plugin affecting versions up to 4.0.1 (NotFound WP IMAP Auth). The root cause is improper neutralization of input during web page generation. CVSS 3.1 base score 7.1 (HIGH) with NETWORK attacker, no user privileges, and user interaction requir...

SUSE CVE-2025-21638

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: authenable: avoid using current-nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the...

UBUNTU-CVE-2025-21638

In the Linux kernel, the following vulnerability has been resolved: sctp: sysctl: authenable: avoid using current-nsproxy As mentioned in a previous commit of this series, using the 'net' structure via 'current' is not recommended for different reasons: - Inconsistency: getting info from the...

CVE-2024-5138: snapd snapctl auth bypass

Impact A snap with prior permissions to create a mount entry on the host, such as firefox, normally uses the permission from one of the per-snap hook programs. A unprivileged users cannot normally trigger that behaviour by using snap run --shell firefox followed by snapctl mount, since snapd...

Malicious code in uber-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 514527f85a2deb8975f95374694c5dc8a3d09d328d3cb7adc36ea16d071367ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-106 Malicious code in uber-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 514527f85a2deb8975f95374694c5dc8a3d09d328d3cb7adc36ea16d071367ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-3553 · Jeewms · Jeewms

Name of the Vulnerable Software and Affected Versions: JeeWMS versions prior to 2025.01.01 Description: The issue is related to a permission bypass in the component /interceptors/AuthInterceptor.cava. This component is part of the JeeWMS system, and the bypass could potentially allow unauthorized...

Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Update to Mozilla Thunderbird ESR 128.6 MFSA 2025-05, bsc1234991 Security fixes: CVE-2025-0237 bmo1915257 WebChannel APIs susceptible to confused deputy attack CVE-2025-0238 bmo1915535 Use-after-free when breaking lines in text...