CVE-2025-59524

Horilla (HRMS) prior to v1.4.0 is affected; file upload validation is only client-side, allowing bypass via crafted requests to store an executable HTML document on the server. When a privileged user views the uploaded file, embedded script can exfiltrate session cookies/credentials to attacker-c...

CVE-2025-59524 Horilla Stored XSS Vulnerability via File Upload in Reimbursement Panel

Horilla is a free and open source Human Resource Management System HRMS. Prior to version 1.4.0, the file upload flow performs validation only in the browser and does not enforce server-side checks. An attacker can bypass the client-side validation for example, with an intercepting proxy or by...

Horilla 代码问题漏洞

Horilla is a free and open source HR software from Horilla Inc. A code issue vulnerability exists in Horilla versions prior to 1.4.0 that stems from a file upload process that performs only browser-side validation without implementing server-side checks, which could lead to stored cross-site...

CVE-2025-54855

CVE-2025-54855 affects AutomationDirect CLICK PLUS/Click Programming Software v3.60. Affected component: Click Programming Software; vulnerability: cleartext storage of sensitive information allowing a local user with file-system access (while an administrator is active) to steal credentials stor...

CVE-2025-34206

Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments mount host configuration and secret material under /var/www/efsstorage into many Docker containers with overly-permissive filesystem permissions. Files such as secrets.env, GPG-encrypted blobs in...

CVE-2025-34200

Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments provision the appliance with the network account credentials in clear-text inside /etc/issue, and the file is world-readable by default. An attacker with local shell access can read /etc/issue to...

CVE-2025-34206 Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions

Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments mount host configuration and secret material under /var/www/efsstorage into many Docker containers with overly-permissive filesystem permissions. Files such as secrets.env, GPG-encrypted blobs in...

CVE-2025-34206

The CVE-2025-34206 entry concerns Vasion Print (PrinterLogic) Virtual Appliance Host and Application. It describes overly-permissive permissions on host files mounted into multiple Docker containers under /var/www/efs_storage, enabling access to secrets.env, GPG-encrypted blobs, MySQL client keys...

CVE-2025-34206 Vasion Print (formerly PrinterLogic) Insecure Shared Storage Permissions

Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments mount host configuration and secret material under /var/www/efsstorage into many Docker containers with overly-permissive filesystem permissions. Files such as secrets.env, GPG-encrypted blobs in...

IBM Copy Services Manager 跨站脚本漏洞

IBM Copy Services Manager is IBM's data replication management software for simplifying and automating data replication operations in enterprise storage environments. A cross-site scripting vulnerability exists in IBM Copy Services Manager 6.3.13, which stems from insufficient filtering and...

Vasion Print和Vasion Print Virtual Appliance Host 安全漏洞

Vasion Print and Vasion Print Virtual Appliance Host are both products of Vasion, Inc.Vasion Print is a SaaS-based cloud hosted application for managing and deploying printers.Vasion Print Virtual Appliance Host is a print management software. A security vulnerability exists in Vasion Print Virtu...

PT-2025-38611

Name of the Vulnerable Software and Affected Versions Vasion Print formerly PrinterLogic Virtual Appliance Host and Application VA and SaaS deployments affected versions not specified Description The Vasion Print Virtual Appliance Host and Application has overly-permissive filesystem permissions...

Cognex In-Sight Explorer and In-Sight Camera Firmware

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to disclose sensitive information, steal credentials, modify files, or cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of...

Malicious code in hello-shai (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 297f2a57d1c225e18d8464c2024daef4567955be0eb8cd8d45052aa778fb4f3a This package was compromised by the Shai-Hulud NPM worm. The malicious payload steals tokens and credentials and publishes them to GitHub...

MAL-2025-47449 Malicious code in another-shai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3fba9cc731c68608bf4548a514b4491220c23775767b250f6c1cc318584a843 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-38483

Name of the Vulnerable Software and Affected Versions affected versions not specified Description An adjacent attacker without authentication can retrieve user-privileged credentials during the firmware upgrade procedure. Recommendations At the moment, there is no information about a newer versio...

New Shai-hulud Worm Infecting npm Packages With Millions of Downloads

ReversingLabs discovers "Shai-hulud," a self-replicating computer worm on the npm open-source registry. Learn how the malware steals developer…...

Malicious code in @strong-energetic/test-banned-file (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security beb2182dad9121d8cdfbd98f321d90cd62cda75f2c4ef68f1a5e22608808dc91 This package was compromised by the Shai-Hulud NPM worm. The malicious payload steals tokens and credentials and publishes them to GitHub...

MAL-2025-47422 Malicious code in devextreme-rpk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f74fc68752b93858b4cd802b0c1c9c940779258a08c206b0787ebf5b94bc9738 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47420 Malicious code in @basic-ui-components-stc/basic-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c7cc4b06e4071b6e4613358e926ea521ee3acb2223670ed3783c57abb5c0567 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...