16955 matches found
MAL-2025-797 Malicious code in analytics-bp-passive-tracker-loader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis acb2b0591e0d61f597b43b55a8fd70dfcb8aca1d696e09f2a63c4f6f5c5a1959 The OpenSSF Package Analysis project identified 'analytics-bp-passive-tracker-loader' @ 99.99.100 npm as malicious. It is considered malicious...
MAL-2025-1106 Malicious code in dbc-wiki (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7a3387dd8d7bee056ed8730751ff10c6b9a5de16814de6072bf8325f339108a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1097 Malicious code in cscropper-vue3 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03314c2593e63f6f953b281505c7a63eaa4fe7c3ffd71eb8fd8c28d5c1c16fd2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-1175 Malicious code in sg_personal_ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6af0cb60de927dce01894374e1ee9541828c4fbef00917a909bbeed4275a817b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Local Privilege Escalation
snowflakeconnectorpython is vulnerable to Local Privilege Escalation. The vulnerability is due to the use of the pickle module for serializing OCSP Online Certificate Status Protocol responses, which allows an attacker to craft malicious data that, when deserialized...
PT-2025-2875 · Averta · Averta Shortcodes
Name of the Vulnerable Software and Affected Versions: By Averta Shortcodes and extra features for Phlox theme versions 2.17.2 and earlier Description: The issue affects the By Averta Shortcodes and extra features for the Phlox theme, allowing exploitation of incorrectly configured access control...
RUSTSEC-2025-0004 ssl::select_next_proto use after free
In openssl versions before 0.10.70, ssl::selectnextproto can return a slice pointing into the server argument's buffer but with a lifetime bound to the client argument. In situations where the server buffer's lifetime is shorter than the client buffer's, this can cause a use after free. This coul...
BELL-CVE-2025-21676
Bulletin has no description...
BELL-CVE-2025-21683
Bulletin has no description...
BELL-CVE-2025-21666
Bulletin has no description...
ASB-A-378455392
In uvcparseformat of uvcdriver.c, there is a possible out of bounds write due to a heap buffer overflow. This could lead to physical escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
ASB-A-359179312
In multiple functions of Parcel.cpp, there is a possible way to manipulate file descriptors and escalate privileges due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
ASB-A-368069390
In GetTable of dm.cpp, there is a possible way to leak the raw FDE key in bug reports due to improperly used crypto. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
CGA-JX6X-2V3Q-XPRW
Bulletin has no description...
CVE-2025-23980
Cross-Site Request Forgery CSRF vulnerability in James Andrews Full Circle full-circle allows Stored XSS.This issue affects Full Circle: from n/a through = 0.5.7.8...
BELL-CVE-2025-0840
Bulletin has no description...
CGA-5PQ9-CCW3-2PR7
Bulletin has no description...
JetBrains Rider 2024.1.x < 2024.1.7 / 2024.2.x < 2024.2.8 / 2024.3.x < 2024.3.4 Local Privilege Escalation (CVE-2025-23385)
The version of JetBrains Rider installed on the remote host 2024.1.x prior to 2024.1.7, 2024.2.x prior to 2024.2.8, or 2024.3.x prior to 2024.3.4. It is, therefore, affected by a local privilege escalation vulnerability: - In JetBrains ReSharper before 2024.3.4, 2024.2.8, and 2024.1.7, Rider befo...
CVE-2025-0477 Rockwell Automation FactoryTalk® AssetCentre Data Exposure Vulnerability
An encryption vulnerability exists in all versions prior to V15.00.001 of Rockwell Automation FactoryTalk® AssetCentre. The vulnerability exists due to a weak encryption methodology and could allow a threat actor to extract passwords belonging to other users of the application...