Security Bulletin: There is a vulnerability in prism-1.28.0.jsused by IBM Maximo Asset Management application ( CVE-2024-53382)

Summary There is a vulnerability in prism-1.28.0.js used by IBM Maximo Asset Management application CVE-2024-53382 Vulnerability Details CVEID:CVE-2024-53382 DESCRIPTION: Prism aka PrismJS through 1.29.0 allows DOM Clobbering with resultant XSS for untrusted input that contains HTML but does not...

USN-7599-1 python-urllib3 vulnerabilities

Jacob Sandum discovered that urllib3 handled redirects even when they were explicitly disabled while using the PoolManager. An attacker could possibly use this issue to obtain sensitive information. CVE-2025-50181 Illia Volochii discovered that urllib3 incorrectly handled retry and redirect...

DEBIAN-CVE-2025-6545

Improper Input Validation vulnerability in pbkdf2 allows Signature Spoofing by Improper Validation. This vulnerability is associated with program files lib/to-buffer.Js. This issue affects pbkdf2: from 3.0.10 through 3.1.2...

Malicious code in js-log-print (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32f7c2522ad9654a06381397d330bacf9a768718488543199f85362870ee4d9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5165 Malicious code in js-log-print (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 32f7c2522ad9654a06381397d330bacf9a768718488543199f85362870ee4d9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in js-log-print

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in readium-shared-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in world-id-js (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in readium-shared-js (npm)

Malicious preinstall script exfiltrates system info hostname, user, pwd, id to a remote server. Likely a malware. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c907ca12944ad675a60dbfd27a1680a1b2ebf1186512d0106676795741a558a Any computer that has this package...

Malware in c2pa-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4888 Malicious code in springboot-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 767553d0189c47e072ca2eccece5b848745a1f6faaf34987293d9232d32f48fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in springboot-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 767553d0189c47e072ca2eccece5b848745a1f6faaf34987293d9232d32f48fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in springboot-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in mockup-js-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d47de2f1ea832ed5ca1de7b318fac1b4e38fd7f83c2b66d97c4c38cfab1da216 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in mockup-js-plugin

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-48877: Insecure Automated Optimizations

Discourse is an open-source discussion platform. Prior to version 3.4.4 of the stable branch, version 3.5.0.beta5 of the beta branch, and version 3.5.0.beta6-dev of the tests-passed branch, Codepen is present in the default allowediframes site setting, and it can potentially auto-run arbitrary JS...

MAL-2025-4733 Malicious code in c2pa-js (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8983a214dc0d52693f13d8a50f2e5d171641b4b847ce37ea539b48f94971e5e0 Any computer that has this package installed or running should be considered...

Malicious code in c2pa-js (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8983a214dc0d52693f13d8a50f2e5d171641b4b847ce37ea539b48f94971e5e0 Any computer that has this package installed or running should be considered...

TinyFileManager Cross-Site Scripting Vulnerability

TinyFileManager is a web-based file manager. It is used for storing, uploading, editing and managing files and folders online through a web browser. TinyFileManager suffers from a cross-site scripting vulnerability that stems from the application's lack of effective filtering and escaping of...

nodejs: Remote Crash via SignTraits::DeriveBits() in Node.js

A flaw was found in Node.js, specifically in the C++ method SignTraits::DeriveBits. This vulnerability can allow a remote attacker to crash the Node.js runtime via untrusted input, triggering an exception in a background thread...