MAL-2025-3673 Malicious code in @johndeere-tech/helios-ng-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cafd54c91f17226053b5247b4cd518c79cc4e6462f2bf35455fc9a9f8b55c42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Samsung SMR security vulnerabilities

SAMSUNG SMR is a system patch package from the South Korean company Samsung SAMSUNG. It provides patches for Samsung mobile applications. SAMSUNG SMR suffers from a security vulnerability that stems from improperly exported Android application components, which could lead to a local attacker...

Samsung SMR security vulnerabilities

SAMSUNG SMR is a system patch package from the South Korean company Samsung SAMSUNG. It provides patches for Samsung mobile applications. SAMSUNG SMR suffers from a security vulnerability that stems from improper export of Android application components in Settings, which could lead to a physical...

PT-2025-20060 · Unknown · Aodservice

Name of the Vulnerable Software and Affected Versions: AODService versions prior to 8.8.28.12 Description: The issue concerns the improper export of Android application components in AODService, allowing local attackers to launch arbitrary activity with systemui privilege. This enables attackers ...

CVE-2025-29154

HTML injection vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via the .galera.app/ted/solicitacaotreinamento/, .galera.app/rh/metas/perspectivaestrategica/edicao/, .galera.app/rh/cadastros/perspectivas/listagem/adc/,...

PT-2025-20294 · Unknown · Koillection

Name of the Vulnerable Software and Affected Versions: Koillection version 1.6.10 Description: A Cross Site Scripting issue allows a remote attacker to escalate privileges via the collection, Wishlist, and album components. Recommendations: For Koillection version 1.6.10, consider restricting...

CVE-2025-29152

Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing, Education Registration, Hierarchical Level Registration...

RockyLinux 9 : mingw components (RLSA-2024:2353)

The remote RockyLinux 9 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2024:2353 advisory. binutils: Heap-buffer-overflow binutils-gdb/bfd/libbfd.c in bfdgetl64 CVE-2023-1579 Tenable has extracted the preceding description block directly from the...

CVE-2025-29152

Cross-Site Scripting vulnerability in lemeconsultoria HCM galera.app v.4.58.0 allows an attacker to execute arbitrary code via multiple components, including Strategic Planning Perspective Registration, Training Request, Perspective Editing, Education Registration, Hierarchical Level Registration...

CVE-2025-29746

The Koillection self-hosted collection management service (version 1.6.10 ) is vulnerable to a Cross-Site Scripting (XSS) flaw. The root cause is insufficient input sanitization within the collection , Wishlist , and album components, which allows a remote attacker to inject malicious scripts and...

Malicious code in @ebay-business-components/marko-rum (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

Cluster Component Data Access

Vulnerability of the MySQL Cluster component: General database management systems related to MySQL Cluster are vulnerable due to deficiencies in access control. Exploiting this vulnerability can allow a malicious actor to gain read, modify, add, or delete access to data, or cause service failures...

MAL-2025-3594 Malicious code in ui-platform-base-components-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b86eb50d9103e65b5af0d24fc0da1302ab769b008a7a2d7c46d686a0fca6d9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ui-platform-base-components-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b86eb50d9103e65b5af0d24fc0da1302ab769b008a7a2d7c46d686a0fca6d9b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in easyship-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb88996af76273910ad50c925b80398cf3500db0b334d4785f6d3d3f415a3b51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in easyship-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-3550 Malicious code in easyship-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb88996af76273910ad50c925b80398cf3500db0b334d4785f6d3d3f415a3b51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Linux kernel DRM/STI DoS

The vulnerability of DRM/STI components in Linux kernel relates to the assignment of the NULL pointer in the stihqvdpatomiccheck function. Exploiting this vulnerability can allow an attacker to trigger a service failure...

CVE-2025-4035

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...

UBUNTU-CVE-2025-4035

A flaw was found in libsoup. When handling cookies, libsoup clients mistakenly allow cookies to be set for public suffix domains if the domain contains at least two components and includes an uppercase character. This bypasses public suffix protections and could allow a malicious website to set...