CVE-2025-20274

A vulnerability in the web-based management interface of Cisco Unified Intelligence Center could allow an authenticated, remote attacker to upload arbitrary files to an affected device. This vulnerability is due to improper validation of files that are uploaded to the web-based management...

Malicious code in @lensapp/eslint-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61bc10b6edfec3225d467f169ee0c13a8d66637e96186f959196d0ae15822ad6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-52089

A hidden remote support feature protected by a static secret in TOTOLINK N300RB firmware version 8.54 allows an authenticated attacker to execute arbitrary OS commands with root privileges...

Malicious code in open-source-catalog (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3bfbe0348c0d5c8d07d2f1fe1b504717cbe1e2f686ce8d05381049ec4df11e0 Any computer that has this package installed or running should be considered...

CVE-2025-20308 Cisco Spaces Connector Privilege Escalation Vulnerability

A vulnerability in Cisco Spaces Connector could allow an authenticated, local attacker to elevate privileges and execute arbitrary commands on the underlying operating system as root. This vulnerability is due to insufficient restrictions during the execution of specific CLI commands. An attacker...

Malicious code in sdk.babelhelpers (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2ecc77e86573c3fd986a8fac35d0368893554af91bcf9f31d8e0c2fa342d3890 Any computer that has this package installed or running should be considered...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the Execute commands feature, which allows shell commands to be executed without restriction to the assigned scope. An attacker can gain unauthorized read and write access to all files managed by the serv...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the Execute commands feature, which allows shell commands to be executed without restriction to the assigned scope. An attacker can gain unauthorized read and write access to all files managed by the serv...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection via the Command Execution process. An attacker can execute arbitrary commands with the privileges of the server process by leveraging allowed shell commands that can spawn additional commands. This is only...

Malicious code in attributors (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dbefeaf34d3565832f706ae95a143747b2d0ff0a593532a3b8088020fd11bc1d The OpenSSF Package Analysis project identified 'attributors' @ 99.99...

CVE-2023-47295

A CSV injection vulnerability in NCR Terminal Handler v1.5.1 allows attackers to execute arbitrary commands via injecting a crafted payload into any text field that accepts strings...

Malicious code in jridgewell-resolve-uri-latest (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4ebc214d374220844dddff1ed8dc339282cd98387925c0d108222a3dc578d430 Any computer that has this package installed or running should be considered...

TrustyAI Explainability 操作系统命令注入漏洞

TrustyAI Explainability is an open source TrustyAI toolkit from TrustyAI. TrustyAI Explainability suffers from an operating system command injection vulnerability that stems from command injection and could result in an authenticated user executing arbitrary commands...

CVE-2025-33117

IBM QRadar SIEM 7.5 through 7.5.0 Update Package 12 could allow a privileged user to modify configuration files that would allow the upload of a malicious autoupdate file to execute arbitrary commands...

Malicious code in vscode-azurecontainerapps (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e5ad54ec265645c2e7358384082a1b1f2385a1caa652b65c359b13681a211b30 Any computer that has this package installed or running should be considered...

Malicious code in zxdb (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b6e6fbdc6289a7a4946e72303aaeb98c9b837470df312ade4e634a7fa81fa52 Any computer that has this package installed or running should be considered...

Malicious code in customdropdownadapter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e29bf2cb2ca6349ffa2030e7ae2a9d4f49fb302fc084fb3ace37e76b543b502 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-41362 Code injection vulnerability in IDF and ZLF

Code injection vulnerability in IDF v0.10.0-0C03-03 and ZLF v0.10.0-0C03-04. This vulnerability allows an attacker to store malicious payload in software that will run in the victim's browser. Exploiting this vulnerability requires authenticating to the device and executing certain commands that...

Malicious code in arc-offsec-custom-library6 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05c0ad6a05bb523b5d5f58ae559288cd55c8c2019374a44703101d1efff52f1b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-4707 Malicious code in virtru-private (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60777031b508b2b27184e7bcdd9afb52ab3ca2e19bda0d7d4dee9333e7ff1190 Any computer that has this package installed or running should be considered...