Malicious code in @hongfangze/obtain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7e4b6cae0530d0f1893a65496fffb1884b47ffc2ef4a507d11fd9c6370baa833 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in degate.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61da5754c936114c5ca17e69053e009e5977b17f1dcda28c83ab085d40b17811 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sensort-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da08217a79ac25925bb75373056d29208390b88fa6a4e75d27f6c5889b5a4943 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nodejs-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78f634e9e89620bdae97a2ba6be1914334b29090ecd8c222adae9b81f2a0bbf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-9098

In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby gaining unauthorized access to billing resources. This issue arises because the user creation endpoint does not restrict admins from invitin...

CVE-2024-9098

In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby gaining unauthorized access to billing resources. This issue arises because the user creation endpoint does not restrict admins from invitin...

CVE-2024-9098 Privilege Escalation in lunary-ai/lunary

In lunary-ai/lunary before version 1.4.30, a privilege escalation vulnerability exists where admins can invite new members with billing permissions, thereby gaining unauthorized access to billing resources. This issue arises because the user creation endpoint does not restrict admins from invitin...

Malicious code in nl-wallet-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8bf94087c465bb67e65d34148f6aad2a5592fa4653e4705ca81533f5ac3f6091 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pkl-lang.org (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e62ea2ef542d2e8dda998bfe58ca7673af23732af531365aeb706076f9ea9fd9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-24843 Dario Health USB-C Blood Glucose Monitoring System Starter Kit Android Application Storage of Sensitive Data in a Mechanism without Access Control

Insecure file retrieval process that facilitates potential for file manipulation to affect product stability and confidentiality, integrity, authenticity, and attestation of stored data...

Malicious code in bithumb-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 486276686eda2f4f675b363605d7e934f7665dfbca8a85f49d8b76a801f7ce43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in htx-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7af8cfe522f6a03c75b9bf02f62bb022b2930607b810b33a905d16a26d2991c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in p2pb2b-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f3406bc1d90365600ac04cb2cc6fcfc8ff98c4d9050b2bc5fa598c3bb3c7da4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in digifinex-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e34f6ee680c72ebf906fbed8f3486f2646dc8d735d0b1a3f732c50eb7ac133ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-41267

SAP Business Objects Platform - versions 420, and 430, allows an attacker with normal BI user privileges to upload/replace any file on Business Objects server at the operating system level, enabling the attacker to take full control of the system causing a high impact on confidentiality, integrit...

Malicious code in timesketch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f93183b686eaf1babd4ed5451b64aea3e83226fa7a581cdb026613583f96fbbf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in metamask-sdk-monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 563827ad840866efcd9358d913c0a4e28044e336ac6d4ebc9a33c631afd70ed4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SquareX Unveils “Browser Syncjacking” Attack Granting Full Browser and Device Control

Palo Alto, USA, 30th January 2025, CyberNewsWire...

pimcore/customer-data-framework vulnerable to SQL Injection

An SQL injection vulnerability allows any authenticated user to execute arbitrary SQL commands on the server. This can lead to unauthorized access to sensitive data, data modification, or even complete control over the server. Details The vulnerability is found in the URL parameters of the...

ABB FLXEON Controllers

SUMMARY An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory. FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter. An attacker can...