Vulnerabilities fixed in Microsoft Developer Tools

Microsoft has fixed vulnerabilities in Visual Studio and .NET. A malicious party could exploit the vulnerabilities to grant themselves elevated privileges, access sensitive data or execute arbitrary code in the victim's context. Successful exploitation requires the malicious party to trick the...

2025-01 Cumulative Update for .NET Framework 3.5, 4.8 and 4.8.1 for Windows 10 Version 21H2 for x64 (KB5050416)

A security issue has been identified in a Microsoft software product that could affect your system. You can help protect your system by installing this update from Microsoft. For a complete listing of the issues that are included in this update, see the associated Microsoft Knowledge Base article...

Insertion of Sensitive Information into Log File

Overview typo3/cms-install is a TYPO3 extension install. The Install Tool is used for installation, upgrade, system administration and setup tasks. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File due to improper handling of sensitive informatio...

GHSA-38X7-CC6W-J27Q TYPO3 Information Disclosure via Exception Handling/Logger

Problem It has been discovered that the install tool password has been logged as plaintext in case the password hashing mechanism used for the password was incorrect. Solution Update to TYPO3 versions 13.4.3 LTS that fixes the problem described. Credits Thanks to TYPO3 core & security team member...

PT-2025-3142 · Typo3 · Typo3

Name of the Vulnerable Software and Affected Versions: TYPO3 versions prior to 13.4.3 ELTS Description: A problem has been discovered where the install tool password is logged as plaintext if the password hashing mechanism used for the password was incorrect. There are no known workarounds for th...

Ubuntu: Security Advisory (USN-7202-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in bigcommerce-cornerstone (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83db5e73ba2655c18a873f73b2875933ac9be69ba593d2b7cd4fc00e6af20bce Any computer that has this package install...

Malicious code in parseq-tracevis (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f1942e5a38dc2f1ef479bf37cdc9f9737c8ffc2798503291d72615802a3a699 Any computer that has this package install...

Malicious code in gatsby-hampton-theme (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14760a588a97ce4f749c5fc92a6eb3c66f77de950ea1a35c92b0dc6ed695b861 Any computer that has this package install...

Malicious code in vscode-gestalt (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b869acaad1d20750b0c435dea2d0a474208819d32ba8a1b00d42d57f850e65ed Any computer that has this package install...

Malicious code in build-stuff (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8b7ff7f3b5a1ee73432fc3f1ace509ffe1fcb48099ecca9aa87e0396fab2a7f8 Any computer that has this package install...

MAL-2025-75 Malicious code in jiolocate-ui (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 632763242c2df9c72854a919e8fd6a0c7a8b6debedb9c7e22cbd886883c4217b Any computer that has this package install...

Malicious code in aem-guides-wknd-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=-...

Malicious code in jupyter-binding (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=-...

MAL-2025-63 Malicious code in aem-guides-wknd-app (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=-...

Malicious code in electron-wix-msi-local (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain...

PT-2025-1950 · Aurum · Aurum

Name of the Vulnerable Software and Affected Versions: Aurum - WordPress & WooCommerce Shopping Theme versions prior to 4.0.3 Description: The issue concerns a missing capability check in the lab 1cl demo install package content function, allowing authenticated attackers with Subscriber-level...

Malicious code in tt4b (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 566cb941a2928e1680d09217c711e1a56aa24333a874bd07cff988cfa17e31eb Any computer that has this package install...

Malicious code in eslint-config-proton-lint (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d595489e0b5943870a58ffcd154d1a8ab7b4bbd45155465dbe9272bb6471060 Any computer that has this package install...

Malicious code in old-mpl-token-metadata (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6603cd004d4fbdaf7a066de7f7057ad66c4108e0bd8d961201d12f326fc1d7bf Any computer that has this package install...