4210 matches found
Malicious code in ch-react-help (npm)
The package ch-react-help was found to contain malicious code...
Malicious code in @help_api/utilities (npm)
The package @helpapi/utilities was found to contain malicious code...
MAL-2025-33162 Malicious code in show-help (npm)
The package show-help was found to contain malicious code...
Malicious code in @help_api/config (npm)
The package @helpapi/config was found to contain malicious code...
Malicious code in @help_center/config (npm)
The package @helpcenter/config was found to contain malicious code...
brick (0.0.0), brick-node (>=0.0.8, <=0.0.17) +30 more potentially affected by unknown CVE via show-help (>=0.0.0, <=2.0.1)
show-help NPM version =0.0.0, =0.0.8, =0.0.0, =0.0.5, =0.0.0, =0.0.0, =0.0.7, =0.0.9, =1.1.0, =1.1.1 and more Source cves: unknown CVE Source advisory: OSV:MAL-2025-33162...
Malicious code in uni-help (npm)
The package uni-help was found to contain malicious code...
Malicious code in @help_api/modules (npm)
The package @helpapi/modules was found to contain malicious code...
Malicious code in @help_center/utilities (npm)
The package @helpcenter/utilities was found to contain malicious code...
Malicious code in @help_center/modules (npm)
The package @helpcenter/modules was found to contain malicious code...
Malicious code in @help_center/types (npm)
The package @helpcenter/types was found to contain malicious code...
Malicious code in show-help (npm)
The package show-help was found to contain malicious code...
SolarWinds Web Help Desk < 12.8.7 XXE Vulnerability
The version of Solarwinds Web Help Desk installed on the remote host is prior to 12.8.7. It is, therefore, affected by a vulnerability. SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid,...
VulnCheck KEV: CVE-2025-2712
A vulnerability was found in Yonyou UFIDA ERP-NC 5.0. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /help/top.jsp. The manipulation of the argument langcode leads to cross site scripting. The attack can be launched remotely. The exploi...
How Scattered Spider Used Fake Calls to Breach Clorox via Cognizant
Specops Software's analysis reveals how Scattered Spider's persistent help desk exploitation cost Clorox $400 million. Understand the August 2023 breach, its operational disruption, and critical steps organisations must take to protect against similar social engineering threats...
CVE-2025-26400 SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability
SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...
CVE-2025-26400 SolarWinds Web Help Desk XML External Entity Injection (XXE) Vulnerability
SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...
PT-2025-31182
Name of the Vulnerable Software and Affected Versions SolarWinds Web Help Desk affected versions not specified Description SolarWinds Web Help Desk is susceptible to an XML External Entity XXE injection issue that may result in information disclosure. Successful exploitation requires valid,...
VulnCheck KEV: CVE-2021-35232
Hard coded credentials discovered in SolarWinds Web Help Desk product. Through these credentials, the attacker with local access to the Web Help Desk host machine allows to execute arbitrary HQL queries against the database and leverage the vulnerability to steal the password hashes of the users ...
CVE-2025-26400: Improper Restriction of XML External Entity Reference
SolarWinds Web Help Desk was reported to be affected by an XML External Entity Injection XXE vulnerability that could lead to information disclosure. A valid, low-privilege access is required unless the attacker had access to the local server to modify configuration files...