MAL-2025-2024 Malicious code in @f2p-mml-frontends/mml-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 983731c41dcce79ac1385591adacf0e23cc21f82e4d2bfadff7fb3bb79cf2e2b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Flask-AppBuilder Observable Response Discrepancy

User enumeration in database authentication in Flask-AppBuilder = 3.0.0. Allows for a non authenticated user to enumerate existing usernames by timing the response time from the server when brute forcing requests to login...

CVE-2025-23405

Unauthenticated log effects metrics gathering incident response efforts and potentially exposes risk of injection attacks ex log injection...

MAL-2025-1666 Malicious code in metrics-aggregator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cd896083dc19fbe781ed9f414bc1a72581378e63717086f459e1b03fd0c058c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-1749

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/voucher...

CVE-2025-1747

HTML injection vulnerabilities in OpenCart versions prior to 4.1.0. These vulnerabilities could allow an attacker to modify the HTML of the victim's browser by sending a malicious URL and modifying the parameter name in /account/login...

MAL-2025-1661 Malicious code in ringcentral-web-phone-v2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5d0cdb47587dfa64b594d26d1b33dea3d9cb70b7f8a581fa66d1f005df4ee60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Advisory ROSA-SA-2025-2753

Software: openssl 1.1.1k OS: ROSA Virtualization 2.1 packageevrstring: openssl-1.1.1.1k-12.0.1.rv3 CVE-ID: CVE-2020-25659 BDU-ID: 2022-05647 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the python-cryptography package of the Python programming language interpreter is related to RSA key management...

MAL-2025-1657 Malicious code in okta-sdk-php-openapi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da144ffdf9eed05ec70b485602e1d3aeae40d312d6fd4eec8956422e2365bd0b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1656 Malicious code in azps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6c955269826233e665b0f2e27c31b025ab3e5ab1ff1a46049d06df4c02d5a48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BELL-CVE-2025-21801

Bulletin has no description...

BELL-CVE-2025-21812

Bulletin has no description...

BELL-CVE-2025-21811

Bulletin has no description...

CVE-2024-37566

Infoblox NIOS through 8.6.4 has Improper Authentication for Grids...

ASB-A-289375038

In handleBondStateChanged of AdapterService.java, there is a possible permission bypass due to misleading or insufficient UI. This could lead to remote proximal/adjacent information disclosure with no additional execution privileges needed. User interaction is needed for exploitation...

ASB-A-386732172

Bulletin has no description...

ASB-A-370958259

In multiple locations, there is a possible way to overlay the installation confirmation dialog due to a tapjacking/overlay attack. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CGA-HVVP-W5FP-MFJ3

Bulletin has no description...

MAL-2025-1587 Malicious code in fb-components-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b0a156cc9bbfceeb92efaaf503c32f71145adbcafa68aa571a5eb055eea23590 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1561 Malicious code in vite_ruby_monorepo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5f016bbad97a0f6e120d5540fe2632278fddf3420077cdcfd4baba37ff8b9580 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...