CVE-2025-13132: Improper Restriction of Rendered UI Layers or Frames

This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification toast appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI like a fake address bar...

CVE-2025-36153

IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-36153 IBM Concert Cross-Site Scripting

IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-55127

HackerOne community member Dao Hoang Anh yoyomiski has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the...

Malicious code in @ra-ide/extension-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a7aa2bba6ddffad751c19fd8291861f53b9994814f0cecb8925b7c2d5c87ae5 The package @ra-ide/extension-ui was found to contain malicious code. Source: ossf-package-analysis...

Security Bulletin: Due to the use of Swagger UI, IBM Security SOAR is vulnerable to spoofing attacks..

Summary IBM Security SOAR uses Swagger-UI internally. CVE-2025-25031 Vulnerability Details CVEID:CVE-2018-25031 DESCRIPTION: Swagger UI 4.1.2 and earlier could allow a remote attacker to conduct spoofing attacks. By persuading a victim to open a crafted URL, an attacker could exploit this...

EUVD-2025-198288

Malicious code in identity-authn-core-ui npm...

MAL-2025-190586 Malicious code in identity-authn-core-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db734e79e178dd70b53bb814581620da1604a06da4967555160d7dfd0d14e0c5 The package identity-authn-core-ui was found to contain malicious code. Source: ossf-package-analysis...

TencentOS Server 4: python-XStatic-jquery-ui (TSSA-2025:0080)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0080 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Google Chrome < 123.0.6312.58 Multiple Vulnerabilities

The version of Google Chrome installed on the remote macOS host is prior to 123.0.6312.58. It is, therefore, affected by multiple vulnerabilities as referenced in the 202403stable-channel-update-for-desktop19 advisory. - Use after free in Canvas in Google Chrome prior to 123.0.6312.58 allowed a...

CVE-2025-55127: Improper Neutralization of Whitespace

HackerOne community member Dao Hoang Anh yoyomiski has reported an improper neutralization of whitespace in the username when adding new users. A username with leading or trailing whitespace could be virtually indistinguishable from its legitimate counterpart when the username is displayed in the...

CVE-2025-36153: Improper Neutralization of Input During Web Page Generation

IBM Concert 1.0.0 through 2.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-13082

User Interface UI Misrepresentation of Critical Information vulnerability in Drupal Drupal core allows Content Spoofing.This issue affects Drupal core: from 8.0.0 before 10.4.9, from 10.5.0 before 10.5.6, from 11.0.0 before 11.1.9, from 11.2.0 before 11.2.8. Mitigation Mitigation for this issue i...

CVE-2025-0421 iFrame Injection in Mikrogrup's Shopside

Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. This issue affects Shopside: through 05022025...

CVE-2025-0421 iFrame Injection in Mikrogrup's Shopside

Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay. This issue affects Shopside: through 05022025...

CVE-2025-13102

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. Chromium security severity: Low...

CVE-2025-12411

The Premmerce Wholesale Pricing for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'ID' parameter in versions up to, and including, 1.1.10. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...

Shopside App 安全漏洞

Shopside App is a shopping application by Shopside Turkey. A security vulnerability exists in Shopside App 05022025 and earlier versions, which stems from improper restriction of the rendering UI layer or frame, which may result in an iFrame override...

PT-2025-48026

Name of the Vulnerable Software and Affected Versions WebKitGTK and WPE WebKit affected versions not specified Description A security issue exists in WebKitGTK and WPE WebKit that allows for an out-of-bounds read and integer underflow. Successful exploitation of this issue can lead to a...

PT-2025-47456

Improper Restriction of Rendered UI Layers or Frames vulnerability in Shopside Software Technologies Inc. Shopside allows iFrame Overlay.This issue affects Shopside: through 05022025...