1755 matches found
MAL-2025-42140 Malicious code in tailwind-react-icon (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a5127a22fb572ebcffe8d5b7a31ef0ceeedc9113e7e1666b1a23384f0ae3cca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
ASB-A-366403307
In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
MAL-2025-42008 Malicious code in icon-sea (npm)
The package icon-sea was found to contain malicious code...
Malicious code in icon-sea (npm)
The package icon-sea was found to contain malicious code...
Malicious code in vite-ts-icon (npm)
The package vite-ts-icon was found to contain malicious code...
MAL-2025-42111 Malicious code in vite-ts-icon (npm)
The package vite-ts-icon was found to contain malicious code...
Linux Distros Unpatched Vulnerability : CVE-2020-9489
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A carefully crafted or corrupt file may trigger a System.exit in Tika's OneNote Parser. Crafted or corrupted files can also cause out of memory errors and/or...
Linux Distros Unpatched Vulnerability : CVE-2018-18247
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga Web 2 before 2.6.2 has XSS via the /icingaweb2/navigation/add icon parameter. CVE-2018-18247 Note that Nessus relies on the presence of the package as...
Linux Distros Unpatched Vulnerability : CVE-2020-24292
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Buffer Overflow vulnerability in load function in PluginICO.cpp in FreeImage 3.19.0 r1859 allows remote attackers to run arbitrary code via opening of crafted i...
Linux Distros Unpatched Vulnerability : CVE-2025-5683
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - When loading a specifically crafted ICNS format image file in QImage then it will trigger a crash. This issue affects Qt from versions 6.3.0 through 6.5.9, from...
Cross-site Scripting (XSS)
Overview mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the node labels which were introduced in 734bde3. An attacker can execute arbitrary JavaScript in the...
Cross-site Scripting (XSS)
Overview org.webjars.npm:mermaid is a package for generation of diagrams and flowcharts from text in a similar manner as markdown. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the node labels which were introduced in 734bde3. An attacker can execute arbitrary...
Cross-site Scripting (XSS)
Overview @mermaid-js/tiny is a Tiny version of mermaid Affected versions of this package are vulnerable to Cross-site Scripting XSS via the node labels which were introduced in 734bde3. An attacker can execute arbitrary JavaScript in the context of the application by injecting malicious HTML...
GHSA-8GWM-58G9-J8PW Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Summary In the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 html method, creating a sink for cross site scripting. Details Architecture diagram service iconText values are passed to the d3 html method, allowing malicious users to...
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Summary In the default configuration of mermaid 11.9.0, user supplied input for architecture diagram icons is passed to the d3 html method, creating a sink for cross site scripting. Details Architecture diagram service iconText values are passed to the d3 html method, allowing malicious users to...
CVE-2025-54880 Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. In the default configuration of mermaid 11.9.0 and earlier, user supplied input for architecture diagram icons is passed to the d3 html...
Linux Distros Unpatched Vulnerability : CVE-2025-5473
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - GIMP ICO File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected...
Malicious code in @zalastax/nolb-_hyper_fun_fluentui-icon-h (npm)
The package @zalastax/nolb-hyperfunfluentui-icon-h was found to contain malicious code...