Security Bulletin: Multiple vulnerabilities in IBM Observability with Instana (OnPrem)

Summary Multiple vulnerabilities were remediated in IBM Observability with Instana OnPrem build 1.0.307 Vulnerability Details CVEID:CVE-2025-57810 DESCRIPTION: jsPDF is a library to generate PDFs in JavaScript. Prior to 3.0.2, user control of the first argument of the addImage method results in C...

CVE-2025-11960

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Aryom Software High Technology Systems Inc. KVKNET allows Reflected XSS. This issue affects KVKNET: before 2.1.8...

CVE-2025-12787

CVE-2025-12787 affects Hydra Booking — Appointment Scheduling & Booking Calendar (WordPress) up to version 1.1.27, allowing unauthenticated cancellation of arbitrary bookings. The root cause is insufficiently random cancellation tokens combined with a globally shared nonce in the tfhb_meeting_for...

CVE-2025-12787 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhbmeetingformsubmitcallback" function using insufficiently random values to generate...

CVE-2025-12787 Hydra Booking – All in One Appointment Booking System | Appointment Scheduling, Booking Calendar & WooCommerce Bookings <= 1.1.27 - Unauthenticated Arbitrary Booking Cancellation via Weak Hash Generation

The Hydra Booking — Appointment Scheduling & Booking Calendar plugin for WordPress is vulnerable to unauthorized booking cancellation in all versions up to, and including, 1.1.27. This is due to the plugin's "tfhbmeetingformsubmitcallback" function using insufficiently random values to generate...

CVE-2025-41731

A vulnerability was identified in the password generation algorithm when accessing the debug-interface. An unauthenticated local attacker with knowledge of the password generation timeframe might be able to brute force the password in a timely manner and thus gain root access to the device if the...

Malicious code in bad_lobster_green-14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 21efefd45db9af7eddd4266ad0cd91490c86d0c3e7d4ac900419a890d8e0b00d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111932 Malicious code in future_deer_aquamarine-97 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8c5aca048db283ba6f0477ee78ef377f0b176bc855f913423e78cb5b859bda6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-112178 Malicious code in patient_spoonbill_gray-49 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2045a997a570254736e4d4300a406ea048194ccdc2471b422d415778280a8bf4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in advisory_asp_replicate_automation (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 788652fa4bffe46698975efc2c68af9ce9d40cf64d60784cbc760d95ebda2051 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cfhdod-notthedevs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050fedfb48e79bfad549b804ae7705b6d4911ef38fc68708f6492693a9573852 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in coming_possum-apptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e4366498e57beca3d73510bbbb01d00007b15ac1383952a7021eda4ee5c75158 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in desperate_crocodile-excellentdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f5f2fcd1f283059f1b0a6184b0e84ec8131bc65b209167f342fec1c6f451972 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in functional_prawn-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 461fb24c2fb17ee5ea26e4e8a2329a964e32ce9c30d2fbbc5feaf9ba40ac8b54 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in glamorous_bedbug-teagooddev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae1852e0fc7e01beef5981371bbe49a9b3faeb728673efa84319035d856a4314 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ugly_finch-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d723b856ef8f8685ddf7caea0ced4c11e863a16cc7df2210b56cd6902ab2f407 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-108642 Malicious code in short_walrus-appteadev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 95fd7db9c0ed81468d63983a59d48080c4c3ad9643baa2fc775cd3fb22ad8a93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-105369 Malicious code in lsoiqi-devapptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8d87798c0fbe9c3c624f08ef9dc030194626fce84315f2d84e82e4159aa9d5aa This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-101231 Malicious code in deaf_xerinae-strongdev (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f1e8a3b674bb0b316c06d56f9e7aa9efac15f38ef3539a29a56950b7834ddecb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-105921 Malicious code in mobile_frog-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector be780881938735641b84298ea503ee9d6ee37e462fd769269d24c69267560d18 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...