MAL-2025-41547 Malicious code in d360-frontend (npm)

--- -= Per source details. Do not edit below this line.=-...

PT-2025-35112

Name of the Vulnerable Software and Affected Versions Volto versions 19.0.0-alpha.1 through 19.0.0-alpha.4 Volto versions 18.0.0 through 18.24.0 Volto versions 17.0.0 through 17.22.1 Volto versions prior to 16.34.0 Description Volto, a React-based frontend for the Plone Content Management System,...

Linux Distros Unpatched Vulnerability : CVE-2019-20379

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ganglia-web aka Ganglia Web Frontend through 3.7.5 allows XSS via the header.php cs parameter. CVE-2019-20379 Note that Nessus relies on the presence of the...

Linux Distros Unpatched Vulnerability : CVE-2022-24349

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An authenticated user can create a link with reflected XSS payload for actions' pages, and send it to other users. Malicious code has access to all the same...

Linux Distros Unpatched Vulnerability : CVE-2022-31084

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LDAP Account Manager LAM is a webfrontend for managing entries e.g. users, groups, DHCP settings stored in an LDAP directory. In versions prior to 8.0 There are...

MAL-2025-42030 Malicious code in msmg-frontend-task (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in msmg-frontend-task (npm)

The package communicates with a domain associated with malicious activity...

Liferay Portal Reflected XSS in CKeditor 4.21.0 endpoint

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

CVE-2025-43761

A reflected cross-site scripting XSS vulnerability in the Liferay Portal 7.4.0 through 7.4.3.131, and Liferay DXP 2024.Q4.0 through 2024.Q4.4, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows an remote non-authenticated...

CVE-2025-43761

Summary of CVE-2025-43761 (NORMAL) Liferay Portal versions 7.4.0–7.4.3.131 and Liferay DXP 2024.Q1.1–Q4.4 (and 7.4 GA through update 92) are affected by a reflected XSS vulnerability. The issue arises from improper input validation in the frontend-editor-ckeditor-web/ckeditor/samples/old/ajax.htm...

PT-2025-34497 · Liferay · Liferay Portal +1

Name of the Vulnerable Software and Affected Versions: Liferay Portal versions 7.4.0 through 7.4.3.131 Liferay DXP versions 2024.Q1.1 through 2024.Q1.12 Liferay DXP versions 2024.Q2.0 through 2024.Q2.13 Liferay DXP versions 2024.Q3.1 through 2024.Q3.13 Liferay DXP versions 2024.Q4.0 through...

Smuggling Requests with Chunked Extensions: A New HTTP Desync Trick

A new HTTP request smuggling technique was recently discovered, where attackers take advantage of inconsistent parsing behaviors between front-end proxy servers and back-end application servers. This attack technique leverages ambiguous request formatting to inject malicious secondary requests th...

Malicious code in @bitkub-next-frontend-v2/app-bitkub-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c961401f308dd3c2e7d4639158b0b6c5cf92dbdfcafb06789988dc4824107960 The OpenSSF Package Analysis project identified '@bitkub-next-frontend-v2/app-bitkub-next' @ 1.13.0 npm as malicious. It is considered malicious...

MAL-2025-41258 Malicious code in @bitkub-next-frontend-v2/app-bitkub-next (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c961401f308dd3c2e7d4639158b0b6c5cf92dbdfcafb06789988dc4824107960 The OpenSSF Package Analysis project identified '@bitkub-next-frontend-v2/app-bitkub-next' @ 1.13.0 npm as malicious. It is considered malicious...

CVE-2025-9100

A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Blog Article Comment Handler. The manipulation leads to authentication bypass by capture-replay. The attack can be initiated remotely. The...

CVE-2025-55299 VaulTLS has a password-based login exploit in additional user accounts

VaulTLS is a modern solution for managing mTLS mutual TLS certificates. Prior to 0.9.1, user accounts created through the User web UI have an empty but not NULL password set, attackers can use this to login with an empty password. This is combined with that fact, that previously disabling the...

CVE-2025-9100

A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Blog Article Comment Handler. The manipulation leads to authentication bypass by capture-replay. The attack can be initiated remotely. The...

CVE-2025-9100 zhenfeng13 My-Blog Frontend Blog Article Comment comment authentication replay

A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Blog Article Comment Handler. The manipulation leads to authentication bypass by capture-replay. The attack can be initiated remotely. The...

My-Blog 安全漏洞

My-Blog is ZHENFENG13 individual developer by SpringBoot + Mybatis + Thymeleaf and other technologies to achieve the Java blog system, page beautiful, full-featured, easy to deploy and perfect code. A security vulnerability exists in My-Blog version 1.0.0, which stems from the lack of protection...

PT-2025-33629 · Zhenfeng13 · Myblog

Name of the Vulnerable Software and Affected Versions: zhenfeng13 My-Blog version 1.0.0 Description: A security flaw has been discovered in zhenfeng13 My-Blog 1.0.0. This vulnerability affects unknown code of the file /blog/comment of the component Frontend Blog Article Comment Handler. The...