Malicious code in boss-ui-ats (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4aa5d2f568d0db7a56731ab67f01754428ac6deeb365683b5fd0ab8a598c26f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

libxslt: Use-After-Free in libxslt numbers.c

A flaw was found in libxslt numbers.c. This vulnerability allows a use-after-free, potentially leading to memory corruption or code execution via nested XPath evaluations where an XPath context node can be modified but not restored...

Amazon AWS CloudFormation Templates Uncontrolled Search Path Element Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Amazon AWS. Authentication is not required to exploit this vulnerability. The specific flaw exists within the installation of AWS Simple Storage Service. When installed from the official GitHub...

PT-2025-15077 · Code Projects · Patient Record Management System

Name of the Vulnerable Software and Affected Versions: code-projects Patient Record Management System version 1.0 Description: A critical issue was found in the Patient Record Management System. This issue affects an unknown part of the file /dental not.php. The manipulation of the itr no argumen...

CVE-2024-4877

OpenVPN version 2.4.0 through 2.6.10 on Windows allows an external, lesser privileged process to create a named pipe which the OpenVPN GUI component would connect to allowing it to escalate its privileges...

Malicious code in windowsreveal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 45eb7752fa24f9edaffa6707ee8ec4e0b1684a637d4d1cc1f6a003d040039332 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-14583 · Mindspore · Mindspore

Name of the Vulnerable Software and Affected Versions: MindSpore version 2.5.0 Description: A vulnerability was found in MindSpore, affecting the function mindspore.numpy.fft.hfftn. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has...

Malicious code in @atulrv1day/unusedpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77df872b6f487ff391d16643aa0a160f89d08f54054931319a0bdb4bc172aaf1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ehackify-example-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 60ffba72c4fb6005e35ffd9acb8fde18eaa73f3c647a76de85a153ed9b5f0a89 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BELL-CVE-2025-21942 CVE-2025-21942 does not affect BellSoft software

Bulletin has no description...

Citrix Storefront - Error "404 - File or directory not found" when accessing Storefront URL

Browsing to Storefront web URL results in below error "404 - File or directory not found. The resource you are looking for might have been removed, had its name changed, or is temporarily unavailable."...

PT-2025-14459 · Assetview +1 · Assetview +1

Name of the Vulnerable Software and Affected Versions: AssetView and AssetView CLOUD affected versions not specified Description: The issue concerns acquiring sensitive information from sent data to the developer. If exploited, sensitive information may be obtained by a remote unauthenticated...

PT-2025-14040 · Unknown · Nmedia Mailchimp

Name of the Vulnerable Software and Affected Versions: Nmedia MailChimp versions n/a through 5.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This means an attacker can inject malicio...

ASB-A-374257207

In isInSignificantPlace of multiple files, there is a possible way to access sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

MongoDB -- Malformed wire protocol messages may cause mongos to crash

[email protected] reports: Specifically crafted MongoDB wire protocol messages can cause mongos to crash during command validation. This can occur without using an authenticated connection. This issue affects MongoDB v5.0 versions prior to 5.0.31, MongoDB v6.0 versions prior to6.0.20 and MongoDB v7...

ASB-A-376674080

In canForward of IntentForwarderActivity.java, there is a possible bypass of the cross profile intent filter most commonly used in Work Profile scenarios due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CGA-RW5F-7VXF-2JC5

Bulletin has no description...

CVE-2025-2975

A vulnerability was found in GFI KerioConnect 10.0.6 and classified as problematic. This issue affects some unknown processing of the file Settings/Email/Signature/EditHtmlSource of the component Signature Handler. The manipulation leads to cross site scripting. The attack may be initiated...

Exploit for CVE-2025-29927

CVE-2025-29927 - Next.js Middleware Authorization Bypass PoC...

Malicious code in safe-package-winrar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c27d534096565af2e39d24d369b9591182d514fe09116eff81e9edd7f80ff022 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...