MAL-2025-1277 Malicious code in probit-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b53f56d9feb1821fb971f6e193dc7ea5df777a9e0136fa3068e4775f197e0e23 Any computer that has this package install...

Malicious code in toobit-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbef733acdf5215bfdef9bb31af40ec7e1bd2fb0cab3167cf10876e9020e971e Any computer that has this package install...

Malicious code in toobit-internal (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dc2372cd3e422972f9e5ad734631f8915a68a2543a638d01de026ebb0d04436 Any computer that has this package install...

Malicious code in toobit-test (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c55608bc5157f14f615aea6e2e8fd8a5004e3a307d5a12e69f5f6d311d2a74c9 Any computer that has this package install...

Malicious code in toobit-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d0f3cbca32c205dc8a61718610eba04f690441add92e4fb0e98f1e3f18f21f9 Any computer that has this package install...

Vulnerability fixed in Apple iOS and iPadOS

Apple has fixed a vulnerability in iOS and iPadOS. A malicious person with physical access to the vulnerable device can exploit the vulnerability to bypass USB restrictions, even when the system is locked. This allows the malicious party to install arbitrary software on the device. Successful abu...

Siemens ModelSim和Siemens Questa 代码问题漏洞

Siemens ModelSim and Siemens Questa are simulation software from Siemens, Germany. A code issue vulnerability exists in Siemens ModelSim and Siemens Questa, which stems from a sample install script included in the affected application that allows a specific executable to be loaded from the curren...

.NET 9.0 Update - February 11, 2025 (KB5052979)

None None...

The vulnerability of the Install component of the Oracle Analytics software solution allows a hacker to gain privileged access to the infrastructure.

The vulnerability of the Install component of the Oracle Analytics software solution is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an attacker to gain privileged access to the infrastructure...

The vulnerability of the Install component of the software tool for managing the life cycle of products in the Oracle Agile PLM Framework allows a perpetrator to disclose protected information.

The vulnerability of the Install component of the software lifecycle management tool for Oracle Agile PLM Framework relates to deficiencies in the authentication mechanism. Exploiting this vulnerability allows a malicious actor to disclose sensitive information through HTTP requests...

Multiple rtmpdump vulnerabilities

The version of rtmpdump contained in this package has multiple known vulnerabilities. Patches This package is abandoned and should not be used anymore. There is no patched release. Workarounds You should install rmtpdump from another source. References...

Prototype Pollution

Overview org.webjars.npm:vxe-table is an A PC form/table component based on Vue , supporting add, delete, modify, query, virtual tree, drag and drop sorting, lazy loading, shortcut menu, data validation, import/export/print, form rendering, custom templates, renderer, JSON configuration. Affected...

PT-2025-5756 · Vxe-Table · Vxe-Table

Name of the Vulnerable Software and Affected Versions: vxe-table version 4.8.10 Description: A prototype pollution in the lib.install function allows attackers to cause a Denial of Service DoS via supplying a crafted payload. Recommendations: For vxe-table version 4.8.10, consider disabling the...

PT-2025-4177 · Samsung · Galaxy Store

Name of the Vulnerable Software and Affected Versions: Galaxy Store versions prior to 4.5.87.6 Description: The issue allows physical attackers to install arbitrary applications, bypassing the restrictions of Setupwizard through an alternate path in Galaxy Store. This enables attackers to...

CVE-2024-35177 Improper Access Control in wazuh-agent

Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. The wazuh-agent for Windows is vulnerable to a Local Privilege Escalation vulnerability...

Malicious code in sigma-payment (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cae3e39d6adad5c19ce159910927557c2e98660ac824828e0eb22a0dce296ae Any computer that has this package install...

MAL-2025-723 Malicious code in sigma-payment (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cae3e39d6adad5c19ce159910927557c2e98660ac824828e0eb22a0dce296ae Any computer that has this package install...

Malicious code in hotmart (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 630908e08c08fe1b728bca7f4dc2b3bad96652d9083d958a6208bd3ea59f1a37 Any computer that has this package install...

MAL-2025-721 Malicious code in actiris (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce42694aa8de599a7fc31c85d8c8bd89e7fd57194eb3b657b584a863fdf3402d Any computer that has this package install...

Arbitrary Code Execution

Overview Affected versions of this package are vulnerable to Arbitrary Code Execution by implanting a malicious wheel file in pip's installation directory, which will replace the module being installed and get executed during installation. Note: The specific vulnerable behavior arises because...