MAL-2025-70942 Malicious code in sufficient-cyan-amphibian (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 726d32263dcf6dbee4cb32a8e8308ed59b2aeea90591651c72aeacf7ce25579c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-45180

Malicious code in sufficientguppyz3n npm...

CVE-2025-48473 FreeScout Vulnerable to Insufficient Authorization

FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.179, when creating a conversation from a message in another conversation, there is no check to ensure that the user has the ability to view this message. Thus, the user can view arbitrary messages from other...

Mozilla -- local code execution

[email protected] reports: Due to insufficient escaping of the newline character in the Copy as cURL feature, an attacker could trick a user into using this command, potentially leading to local code execution on the user's system...

Malicious code in deltaprime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f16f2e9ed1af46506269c020785db3858769c420b642162e9fa880a6d2152edb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-12066

The SMSA Shippingofficial plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the smsadeletelabel function in all versions up to, and including, 2.3. This makes it possible for authenticated attackers, with Subscriber-level access and above, t...

CVE-2023-51648 Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability

Allegra getFileContentAsString Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of Allegra. Although authentication is required to exploit this vulnerability, the product implements a...

Malicious code in octopus-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4f2d9eb61053da88b3c1c9f3f9cda88f3974f897595acd8e1c42ebef0aec126 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-37408: Improper Authentication

fprintd through 1.94.3 lacks a security attention mechanism, and thus unexpected actions might be authorized by "auth sufficient pamfprintd.so" for Sudo. NOTE: the supplier disputes this because they believe issue resolution would involve modifying the PAM configuration to restrict pamfprintd.so ...

CVE-2024-28826

Summary: CVE-2024-28826 affects Checkmk installations prior to 2.3.0p4, 2.2.0p27, 2.1.0p44, and 2.0.0 (EOL). Root cause: Improper restriction of local upload/download paths in the check_sftp function. Impact: Attackers with sufficient permissions can configure the check to read and write local fi...

composerly.com Cross Site Scripting vulnerability OBB-3930188

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

limona.online Cross Site Scripting vulnerability OBB-3891674

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Malicious code in wlwz-2312-1601 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c5bc0e7158d5619f4e675f0c91a267739b04b6497be26ddeaa336c28335e8a06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-3606 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95c379132458ded3ff8a9400c36f4601958d2cf377f082e2acc8ed174fbbfc63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross Site Scripting(XSS)

sympa:sid is vulnerable to cross-site scripting. The vulnerability due to Inappropriate use of the cookie parameter is both a salt for stored passwords. It leads to XSS due to parameter may also not provide sufficient security...

tributes.merimbulanewsweekly.com.au Cross Site Scripting vulnerability OBB-3771687

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

What is a Polymorphic Virus detection and best practices ?

In the ever-evolving sphere of digital tech, the persistent threat of cyber intrusions remains a formidable concern. A notable example is the polymorphic virus, an insidiously clever adversary in the landscape of cyber threats. Let's probe the intrinsic nature, attributes, and behaviors of this...

element-web -- Cross site scripting in Export Chat feature

Matrix Developers reports: The Export Chat feature includes certain attacker-controlled elements in the generated document without sufficient escaping, leading to stored XSS...

Malicious code in s3mock-testsupport-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da701e874fffc0d3cb4edaa4561c630f6837ad971b3852258c4cf999277f4442 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

barilan-magazine.co.il Cross Site Scripting vulnerability OBB-2757806

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...