CVE-2025-27026

A missing double-check feature in the WebGUI for CLI deactivation in Infinera G42 version R6.1.3 allows an authenticated administrator to make other management interfaces unavailable via local and network interfaces. The CLI deactivation via the WebGUI does not only stop CLI interface but...

Malicious code in servula (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8505d9630f35be52fc05427d2e1cbc9e0fe1ec0de764803117447e8b0b8d265e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

File Browser's password protection of links is bypassable

Summary Files managed by the File Browser can be shared with a link to external persons. While the application allows protecting those links with a password, the implementation is error-prone, making an incidental unprotected sharing of a file possible. Impact File owners might rest in the...

Malicious code in vite-logify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e65a157421ab735107ae923596b8ab46c598935d30810b1e0ccf879388850ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-49192

The web application is vulnerable to clickjacking attacks. The site can be embedded into another frame, allowing an attacker to trick a user into clicking on something different from what the user perceives. This could potentially reveal confidential information or allow others to take control of...

Malicious code in ve-vores (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dcef286db1ecd73863ccb186a0860866493f59111555883f1eeea823933a163f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Siemens Energy Services

SUMMARY Siemens Energy Services previously known as Managed Applications and Services, sell solutions using Elspec G5 Digital Fault Recorder which contains default credentials with admin privileges. A client configuration with remote access could allow an attacker to gain remote control of the...

Malicious code in nethereum-helper-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d1113e69bfa84d519a1db8e7d38e9f66170f41d55f60398de2f057c298838d76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in skinnyvans-linux-arm64 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 78bb320c57a11fc61b5db53653bf51fb93b078e579dcfae939e15a6749c139aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ml-preprocessing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 449fa18004b9f5016f86ea6f5c97358b4ca5263d4649325b946379ca51610f63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-0104

The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. This may allow an attacker to gain control of the user’s computer or gain access to sensitive data...

CVE-2023-37273

Auto-GPT is an experimental open-source application showcasing the capabilities of the GPT-4 language model. Running Auto-GPT version prior to 0.4.3 by cloning the git repo and executing docker compose run auto-gpt in the repo root uses a different docker-compose.yml file from the one suggested i...

Malicious code in internalwkl-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 929f2a7e5622ef6954156300b8095508bdebc3f69573d35fdcdb9785504809ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jquery.currencies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e84dbc5236755b427f757bbfee2cc19e5bcaa36be99d85cbe488921ecc812f5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2019-12503

Due to unencrypted and unauthenticated data communication, the wireless barcode scanner Inateck BCST-60 is prone to keystroke injection attacks. Thus, an attacker is able to send arbitrary keystrokes to a victim's computer system, e.g., to install malware when the target system is unattended. In...

Malicious code in @ducksthegoatedone/ducks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07996ce8fcdd695995919d84cd1d62b1a127fab349bef9399e413b78c2ba1fab Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wix-pilot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1ece1c13a8175e046cf322db45e66e2b92e54bcd72dcacc389a974c1bd7bdbf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in apache-httpclient (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a77347ebb8573c5fbeca35230df16ec582c33958e0a5bad13704efdea35f24eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bmw-fedev/auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aaf1cfd96aa6434cb73b22f2e38fda0979e7847fff11c575bd67ea8e2f09c8f4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in twc-app-example-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 274ea59bea6b31be4c1b08dce0b142ccdff5b3d9541c5edecd6cab49226d93cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...