CVE-2025-58172 drawnix debug logging cross-site scripting vulnerability

drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting XSS vulnerability exists in the debug logging functionality. User controlled content is inserted directly into the DOM via innerHTML without sanitization when the global function...

CVE-2025-58172 drawnix debug logging cross-site scripting vulnerability

drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting XSS vulnerability exists in the debug logging functionality. User controlled content is inserted directly into the DOM via innerHTML without sanitization when the global function...

CVE-2025-58172

The CVE-2025-58172 issue affects drawnix versions through 0.2.1, where the debug logging logger inserts untrusted content directly into the DOM via innerHTML without sanitization (in apps/web/src/app/app.tsx). The root cause is unsanitized user-controlled data being written to the DOM through the...

CVE-2025-58172

drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting XSS vulnerability exists in the debug logging functionality. User controlled content is inserted directly into the DOM via innerHTML without sanitization when the global function...

Malicious Package

Overview newrelic-logging is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malware in newrelic-logging

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in newrelic-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9474b4b491d2662f1018b623e7ee7428918e6c007d0faa6aad7fbcc3d067d78e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47194 Malicious code in newrelic-logging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9474b4b491d2662f1018b623e7ee7428918e6c007d0faa6aad7fbcc3d067d78e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-37811

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 26 iPadOS versions prior to 26 macOS versions prior to Tahoe 26 tvOS versions prior to 26 watchOS versions prior to 26 visionOS versions prior to 26 Description: A logging issue allowed an application to potentially acce...

PT-2025-37845

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 26 iPadOS versions prior to 26 macOS versions prior to Tahoe 26 tvOS versions prior to 26 watchOS versions prior to 26 visionOS versions prior to 26 Description: A logging issue allowed an application to potentially acce...

Apple多款产品 安全漏洞

Apple iOS is an operating system developed for mobile devices.Apple tvOS is an operating system for smart TVs.Apple iPadOS is an operating system for iPad tablets.Apple iOS is an operating system for mobile devices.Apple tvOS is an operating system for smart TVs.Apple tvOS is an operating system...

CVE-2025-58172: Improper Neutralization of Input During Web Page Generation

drawnix is an all in one open-source whiteboard tool. In drawnix versions through 0.2.1, a cross-site scripting XSS vulnerability exists in the debug logging functionality. User controlled content is inserted directly into the DOM via innerHTML without sanitization when the global function...

CVE-2025-43354: Insertion of Sensitive Information into Log File

A logging issue was addressed with improved data redaction. This issue is fixed in iOS 26 and iPadOS 26, macOS Tahoe 26, tvOS 26, visionOS 26, watchOS 26. An app may be able to access sensitive user data...

CVE-2025-58434

Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5 and earlier, the forgot-password endpoint in Flowise returns sensitive information including a valid password reset tempToken without authentication or verification. This enables any attacker...

clusterd

This is an open-source application server attack toolkit called clusterd. It automates the fingerprinting, reconnaissance, and exploitation phases of an application server attack. The toolkit currently supports six different application server platforms, with several more in development and...

BIT-NIFI-2020-1928

An information disclosure vulnerability was found in Apache NiFi 1.10.0. The sensitive parameter parser would log parsed values for debugging purposes. This would expose literal values entered in a sensitive property when no parameter was present...

Vulnerabilities fixed in Cisco NX-OS Software

Cisco has fixed vulnerabilities in Cisco NX-OS Software for Nexus 3000 and 9000 Series Switches. The vulnerabilities are in several features of the Cisco NX-OS Software, including IS-IS, PIM6, logging, command-line interface CLI, and the REST API of the Nexus Dashboard. These vulnerabilities can ...

PT-2025-37039

Name of the Vulnerable Software and Affected Versions: AxxonSoft Axxon One / AxxonNet versions 2.0.4 and earlier Description: The ARP Agent component in AxxonSoft Axxon One / AxxonNet contains a flaw where sensitive information is inserted into log files. A local attacker can obtain plaintext...

Linux Distros Unpatched Vulnerability : CVE-2025-6711

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been identified in MongoDB Server where unredacted queries may inadvertently appear in server logs when certain error conditions are encountered...

Linux Distros Unpatched Vulnerability : CVE-2023-45158

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An OS command injection vulnerability exists in web2py 2.24.1 and earlier. When the product is configured to use notifySendHandler for logging not the default...