SolarWinds Web Help Desk code-related vulnerabilities

SolarWinds Web Help Desk is a suite of help desk and asset management software from US-based SolarWinds. The software supports centralized knowledge base, IT asset management, project and task management, and other features. A code issue vulnerability exists in SolarWinds Web Help Desk that...

CVE-2025-54366 FreeScout's deserialization of untrusted data leads to Remote Code Execution

FreeScout is a lightweight free open source help desk and shared inbox built with PHP Laravel framework. In versions 1.8.185 and below, there is a critical deserialization vulnerability in the /conversation/ajax endpoint that allows authenticated users with knowledge of the APPKEY to achieve remo...

PT-2025-42835

Уязвимость сценария /help/mailbox id системы управления службой поддержки FreeScout связана с недостатками механизма десериализации. Эксплуатация уязвимости может позволить нарушителю, действующему удаленно, выполнить произвольный код...

Malware in jira-help-tips

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-41439

CVE-2025-41439 describes a reflected cross-site scripting vulnerability in the SLNX Help Documentation of Ricoh Streamline NX. The issue arises from a vulnerable parameter which can cause arbitrary scripts to run in a user’s browser when the product is accessed. Concrete details from connected so...

Security update for yelp

This update for yelp fixes the following issues: CVE-2025-3155: JavaScript code execution and arbitrary file read through specially crafted help files and ghelp scheme URLs bsc1240688. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for yelp

This update for yelp fixes the following issues: CVE-2025-3155: JavaScript code execution and arbitrary file read through specially crafted help files and ghelp scheme URLs bsc1240688. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Security update for yelp-xsl

This update for yelp-xsl fixes the following issues: CVE-2025-3155: JavaScript code execution and arbitrary file read through specially crafted help files and ghelp scheme URLs bsc1240688. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Ricoh Streamline NX Client Tool Cross-site Scripting Vulnerability

Ricoh Streamline NX Client Tool is a scalable document management application and tool from Ricoh Japan. A cross-site scripting vulnerability exists in Ricoh Streamline NX Client Tool, which stems from unvalidated specific parameters in the SLNX help documentation and could lead to a reflected...

CVE-2025-41439: Improper Neutralization of Input During Web Page Generation

A reflected cross-site scripting vulnerability via a specific parameter exists in SLNX Help Documentation of RICOH Streamline NX. If this vulnerability is exploited, an arbitrary script may be executed in the web browser of the user who accessed the product...

Security update for yelp-xsl

This update for yelp-xsl fixes the following issues: CVE-2025-3155: JavaScript code execution and arbitrary file read through specially crafted help files and ghelp scheme URLs bsc1240688. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

Malicious code in jira-help-tips (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8b0652aee06598b2ce4f2f215e70f168e2d91b3058832a20069ac391d6a3c0d Any computer that has this package installed or running should be considered...

CLSA-2025-1750782430 yelp: Fix of CVE-2025-3155

CVE-2025-3155: fix execution of arbitrary scripts in help documents, preventing malicious file exfiltration...

FreeBSD : Yelp -- arbitrary file read (9449f018-84a3-490d-959f-38c05fbc77a7)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 9449f018-84a3-490d-959f-38c05fbc77a7 advisory. [email protected] reports: A flaw was found in Yelp. The Gnome user help application allows the help...

FreeBSD : Yelp -- arbitrary file read (0e200a73-289a-489e-b405-40b997911036)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 0e200a73-289a-489e-b405-40b997911036 advisory. [email protected] reports: A flaw was found in Yelp. The Gnome user help application allows the help...

Google Warns of Scattered Spider Attacks Targeting IT Support Teams at U.S. Insurance Firms

The notorious cybercrime group known as Scattered Spider aka UNC3944 that recently targeted various U.K. and U.S. retailers has begun to target major insurance companies, according to Google Threat Intelligence Group GTIG. "Google Threat Intelligence Group is now aware of multiple intrusions in t...

SolarWinds Web Help Desk AjaxProxy Deserialization of Untrusted Data Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Web Help Desk. Authentication is not required to exploit this vulnerability. The specific flaw exists within the AjaxProxy. The issue results from the lack of proper validation of...

Astra Linux – Vulnerability in Yelp

A flaw was discovered in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability enables malicious users to input help documents, which may result in the exfiltration of user files to an external environment...

Security update for yelp

This update for yelp fixes the following issues: CVE-2025-3155: JavaScript code execution and arbitrary file read through specially crafted help files and ghelp scheme URLs bsc1240688. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST...

VulnCheck KEV: CVE-2002-1131

Cross-site scripting vulnerabilities in SquirrelMail 1.2.7 and earlier allows remote attackers to execute script as other web users via 1 addressbook.php, 2 options.php, 3 search.php, or 4 help.php...