31887 matches found
ROS-20260910-73-0111
The vulnerability of the Geolocation component in Google Chrome and Microsoft Edge is related to the user interface’s false representation of critical information. Exploiting this vulnerability can allow an attacker to compromise data integrity through a specially created HTML page...
Malicious code in @auction-fe/ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0383eb0003b48f9a03fefc5a97f9a4b4a2c7756fa1cbced8995bb05838ff404f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
MAL-2026-16109 Malicious code in @auction-fe/ui-kit (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0383eb0003b48f9a03fefc5a97f9a4b4a2c7756fa1cbced8995bb05838ff404f The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...
LF Edge eKuiper: Self-XSS in External Service Creation
Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...
GHSA-G8RH-FJM6-H2H9 LF Edge eKuiper: Self-XSS in External Service Creation
Summary A Cross-Site Scripting XSS vulnerability in external service creation allows an authenticated attacker to inject HTML/script payloads into external service names, which may execute in a user's browser when rendered by administrative web interfaces. Details Prior to v2.4.0, external servic...
DEBIAN-CVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...
CVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...
CVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...
CVE-2026-18147 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...
CVE-2026-18147 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...
EUVD-2026-75108
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...
CVE-2026-18147
A flaw was found in FreeIPA. An unauthenticated remote attacker could exploit a DOM Cross-Site Scripting XSS vulnerability in the FreeIPA/IdM Web UI password reset page. By enticing a victim to click a specially crafted link and complete a password reset, the attacker could inject and execute...
Security Bulletin: IBM ContextForge MCP Gateway is affected by use of default credentials
Summary IBM ContextForge MCP Gateway contains three password configuration fields platformadminpassword, defaultuserpassword, and basicauthpassword that ship with the publicly known default value "changeme". When an operator enables basic authentication apiallowbasicauth or the administrative UI...
firefox: thunderbird: Information disclosure in the DOM: UI Events & Focus Handling component
A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Information disclosure in the DOM: UI Events & Focus Handling component...
Malicious Package
Overview @aspect-adv-ui/consent-manager is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious...
Malicious Package
Overview bx-ui-view is a malicious package. This package contains malicious code. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship. Remediation Avoid using all malicious instances of the...
CVE-2026-21110
Out-of-bounds write in libsavscmn.so prior to One UI 8.5 allows local attackers to execute arbitrary code...
CVE-2026-21111
Out-of-bounds write in libsthmbc.so prior to One UI 8.5 allows local attackers to write out-of-bounds memory...
CVE-2026-21111
CVE-2026-21111 is an out-of-bounds write vulnerability in the libsthmbc.so library affecting Samsung One UI devices prior to One UI 8.5 . A local attacker with low privileges can write to out-of-bounds memory, potentially compromising the confidentiality of the vulnerable system (CVSS 4.0 score 6...