MAL-2025-5716 Malicious code in phone-mockup-react-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f6a1418f459219963b15e9792b3f8721f33e7d7f3bf802a570652c6f3a5faad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-4855 Support Board <= 3.8.0 - Unauthenticated Authorization Bypass due to Use of Default Secret Key

The Support Board plugin for WordPress is vulnerable to unauthorized access/modification/deletion of data due to use of hardcoded default secrets in the sbencryption function in all versions up to, and including, 3.8.0. This makes it possible for unauthenticated attackers to bypass authorization...

CVE-2025-3780 WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible <= 6.7.16 - Missing Authorization to Unauthenticated Plugin Settings Modification

The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the wcfmredirecttosetup function in all versions up to, and including, 6.7.16. This makes i...

MAL-2025-5667 Malicious code in appf-react-router-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bee107551e93c84b7b5e64794220ddf4898466e42cd01d1bdde8b41bb0cabd83 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5662 Malicious code in @instant-postgres/neon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5998172caafd763bd9d8fc92acc7e18e96f4a14c19f5871e16257eaff6547366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Microsoft Windows BitLocker 安全漏洞

Microsoft Windows BitLocker is a BitLocker by Microsoft Corporation USA Ensure secure backup of recovery keys before activating protection. A security vulnerability exists in Microsoft Windows BitLocker. An attacker could bypass certain features by exploiting the vulnerability. The following...

Microsoft Windows BitLocker 安全漏洞

Microsoft Windows BitLocker is a BitLocker by Microsoft Corporation USA Ensure secure backup of recovery keys before activating protection. A security vulnerability exists in Microsoft Windows BitLocker. An attacker could bypass certain features by exploiting the vulnerability. The following...

Cleartext storage of sensitive information in Brocade SANnav server audit logs. (CVE-2025-6390)

Brocade SANnav before SANnav 2.4.0a logs passwords and pbe keys in the Brocade SANnav server audit logs after installation and under specific conditions. These audit logs are the local server VM’s audit logs and are not controlled by SANnav. These logs are only visible to the server admin of the...

PT-2025-28802 · WordPress · Wcfm – Frontend Manager For Woocommerce +1

Name of the Vulnerable Software and Affected Versions: WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress versions up to and including 6.7.16 Description: The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription...

Enhancing LLM Watermark Resilience against Both Scrubbing and Spoofing Attacks

Watermarking is a promising defense against the misuse of large language models LLMs, yet it remains vulnerable to scrubbing and spoofing attacks. This vulnerability stems from an inherent trade-off governed by watermark window size: smaller windows resist scrubbing better but are easier to...

Microsoft Windows BitLocker 安全漏洞

Microsoft Windows BitLocker is a BitLocker by Microsoft Corporation USA Ensure secure backup of recovery keys before activating protection. A security vulnerability exists in Microsoft Windows BitLocker. An attacker could bypass certain features by exploiting the vulnerability. The following...

Microsoft Windows BitLocker 安全漏洞

Microsoft Windows BitLocker is a BitLocker by Microsoft Corporation USA Ensure secure backup of recovery keys before activating protection. A security vulnerability exists in Microsoft Windows BitLocker. An attacker exploiting this vulnerability could bypass certain features. The following produc...

Microsoft Windows BitLocker 安全漏洞

Microsoft Windows BitLocker is a BitLocker by Microsoft Corporation USA Ensure secure backup of recovery keys before activating protection. A security vulnerability exists in Microsoft Windows BitLocker. An attacker exploiting this vulnerability could bypass certain features. The following produc...

USN-7619-1 libssh vulnerabilities

Ronald Crane discovered that libssh incorrectly handled certain base64 conversions. An attacker could use this issue to cause libssh to crash, resulting in a denial of service, or possibly execute arbitrary code. CVE-2025-4877 Ronald Crane discovered that libssh incorrectly handled the...

CVE-2025-3466 Unsanitized Input in langgenius/dify

langgenius/dify versions 1.1.0 to 1.1.2 are vulnerable to unsanitized input in the code node, allowing execution of arbitrary code with full root permissions. The vulnerability arises from the ability to override global functions in JavaScript, such as parseInt, before sandbox security restrictio...

Splunk Cloud Platform和Splunk Enterprise 信息泄露漏洞

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk, Inc. of the U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. An information disclosure vulnerability exists...

Exploit for Improper Authentication in Dahuasecurity Ipc-Hum7Xxx_Firmware

PoC misc PoC - Internet of InSecurity Things Well worth to read about these crappy insecurity things: https://ipvm.com/reports/security-exploits Hikvision CVE-2021-36260 --- 2021-10-19 All credit to WatchfulIP https://watchfulip.github.io/ https://github.com/mcw0/PoC/blob/master/CVE-2021-36260.py...

MAL-2025-5639 Malicious code in print-vault-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0e05d07d0cbe84e8ef4ca39905adcf78905393b39d322ae7e582ad1ae99b177a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

OESA-2025-1747 edk2 security update

EDK II is a modern, feature-rich, cross-platform firmware development environment for the UEFI and PI specifications. Security Fixes: Issue summary: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow. Impact summary: Applications th...

MAL-2025-5673 Malicious code in ca-ui-carbon-toolkit (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7fe942358c29b14aaa3755810e04ffe2cd696331434ed03a940060449bb9d05 Any computer that has this package installed or running should be considered...