EUVD-2025-50205

Malicious code in femaleponyz3n npm...

EUVD-2025-49451

Malicious code in rivalponyz3n npm...

Malicious code in rival_pony_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8daaeb7f8918f628cb182f63c9a036c463849b248ab6b34d6d28e1e69824881b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2007-4030

Malware in sbrugna...

EUVD-2017-14738

Malware in sbrugna...

EUVD-2019-1005

Malware in sbrugna...

EUVD-2014-7611

Malware in sbrugna...

EUVD-2016-5449

Malware in sbrugna...

pony-expres.cz Cross Site Scripting vulnerability OBB-3259605

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

‘DarkWatchman’ RAT Shows Evolution in Fileless Malware

A novel remote access trojan RAT being distributed via a Russian-language spear-phishing campaign is using unique manipulation of Windows Registry to evade most security detections, demonstrating a significant evolution in fileless malware techniques. Dubbed DarkWatchman, the RAT – discovered by...

pony-visa.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-1152146 Security Researcher Gh05tPT Helped patch 6892 vulnerabilities Received 10 Coordinated Disclosure badges Received 48 recommendations , a holder of 10 badges for responsible and coordinated disclosure, found a security vulnerability affecting pony-visa.com website an...

Popular Malware Families Using 'Process Doppelgänging' to Evade Detection

The fileless code injection technique called Process Doppelgänging is actively being used by not just one or two but a large number of malware families in the wild, a new report shared with The Hacker News revealed. Discovered in late 2017, Process Doppelgänging is a fileless variation of Process...

GreenFlash Sundown exploit kit expands via large malvertising campaign

Exploit kit activity has been relatively quiet for some time, with the occasional malvertising campaign reminding us that drive-by downloads are still a threat. However, during the past few days we noticed a spike in our telemetry for what appeared to be a new exploit kit. Upon closer inspection ...

CVE-2019-0218

A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface...

Cross site scripting

A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface...

CVE-2019-0218

A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface...

CVE-2019-0218

A vulnerability was discovered wherein a specially crafted URL could enable reflected XSS via JavaScript in the pony mail interface...

CVE-2019-0218

CVE-2019-0218 affects the Pony Mail interface, where a specially crafted URL enables reflected XSS via JavaScript. Root cause: insufficient validation/handling of URL input in the interface leading to script execution. Exploitation details are not provided in the connected documents; no remediati...

Apache Pony Mail Information Disclosure Vulnerability

Apache Pony Mail is a plug-in with mail archiving, viewing and interaction capabilities from the Apache USA Software Foundation. A security vulnerability exists in the statistics generator in Apache Pony Mail versions 0.7 through 0.9, which stems from the statistics generator returning timestamp...

CVE-2017-5658

The statistics generator in Apache Pony Mail 0.7 to 0.9 was found to be returning timestamp data without proper authorization checks. This could lead to derived information disclosure on private lists about the timing of specific email subjects or text bodies, though without disclosing the conten...