8884 matches found
MAL-2025-46969 Malicious code in chalk (npm)
The package was compromised and malicious code added. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 985b6546ed08c8482326a4819faec318c27c1f6d7518acdf384d5f5a8c1453aa Any computer that has this package installed or running should be considered fully compromised. All...
Out-of-bounds Write
Overview Affected versions of this package are vulnerable to Out-of-bounds Write in the WriteBlob function. An attacker can achieve memory corruption, by manipulating the stream offset using a forward seek beyond the current buffer extent and then performing a write operation. This allows writing...
MAL-2025-42145 Malicious code in logging-winston (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0433a58c0d2019ba753b2ac69bc12319ce704bc3fcf7ff537ccea2164e1e8f31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-41035
A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on th...
CVE-2025-41035
A problem has been discovered in appRain CMF 4.0.5. An authenticated Path Traversal vulnerability in /apprain/common/download/ allows remote users to bypass the intended SecurityManager restrictions and download any file if they have adequate permissions outside the document root configured on th...
CVE-2025-41035
appRain CMF 4.0.5 contains an authenticated path traversal vulnerability in the /apprain/common/download/ endpoint. The issue arises from handling of base64-encoded path parameters after /download/, allowing an attacker with sufficient permissions to access files outside the document root. Connec...
MAL-2025-42138 Malicious code in mathy-console (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40181e61c8885579610a7982c1d9bb6de781022905e9b58618fd8206ba45347b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in tailwind-react-icon (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a5127a22fb572ebcffe8d5b7a31ef0ceeedc9113e7e1666b1a23384f0ae3cca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
It was possible to move the cursor using pointerlock from an iframe. This allowed moving the cursor outside of the viewport and the Firefox window. This vulnerability affects Firefox < 128 and Thunderbird < 128.
...
CVE-2021-4459
An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices...
CVE-2025-9345
CVE-2025-9345 : Path Traversal to Arbitrary File Download in the WordPress plugin “File Manager, Code Editor, and Backup by Managefy.” Affected versions: all up to 1.4.8. Root cause per sources: authenticated users (Subscriber level and higher) can leverage ajax_downloadfile() to access files out...
CVE-2021-4459
An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected Sunny Boy devices...
CVE-2021-4459
CVE-2021-4459 is a directory traversal vulnerability in SMA Sunny Boy inverters. The issue allows an authenticated remote attacker to access files/directories outside the web root, potentially exposing sensitive system information on affected Sunny Boy devices. The CVE is described with the title...
PT-2025-34841 · Sma Solar Technology · Sunny Boy
Name of the Vulnerable Software and Affected Versions: Sunny Boy affected versions not specified Description: An authorized remote attacker can access files and directories outside the intended web root, potentially exposing sensitive system information of the affected devices. Recommendations: A...
Linux Distros Unpatched Vulnerability : CVE-2020-8227
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Missing sanitization of a server response in Nextcloud Desktop Client 2.6.4 for Linux allowed a malicious Nextcloud Server to store files outside of the dedicat...
Google to Verify All Android Developers in 4 Countries to Block Malicious Apps
Google has announced plans to begin verifying the identity of all developers who distribute apps on Android, even for those who distribute their software outside the Play Store. "Android will require all apps to be registered by verified developers in order to be installed by users on certified...
CVE-2025-43759
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the...
CVE-2025-27217
A Server-Side Request Forgery SSRF in the UISP Application may allow a malicious actor with certain permissions to make requests outside of UISP Application scope...
Liferay Portal users are able to add system admin portlets to pages
Liferay Portal versions 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the...
CVE-2025-43759
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q1.0, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.14 and 7.4 GA through update 92 allows admin users of a virtual instance to add pages that are not in the...