GHSA-7C78-RM87-5673 MS SWIFT WEB-UI RCE Vulnerability

I. Detailed Description: This includes scenarios, screenshots, vulnerability reproduction methods. For account-related vulnerabilities, please provide test accounts. If the reproduction process is complex, you may record a video, upload it to Taopan, and attach the link. 1. Install ms-swift pip...

Devolutions Server <= 2025.2.4.0 UI Discrepancy for Security Feature (DEVO-2025-0013) (CVE-2025-8353)

The version of Devolutions Server installed on the remote host is prior or equal to 2025.2.4.0 and is, therefore, affected by a UI discrepancy for security feature vulnerability: - UI synchronization issue in the Just-in-Time JIT access request approval interface in Devolutions Server 2025.2.4.0...

SUSE CVE-2022-31160

jQuery UI is a curated set of user interface interactions, effects, widgets, and themes built on top of jQuery. Versions prior to 1.13.2 are potentially vulnerable to cross-site scripting. Initializing a checkboxradio widget on an input enclosed within a label makes that parent label contents...

MAL-2025-6736 Malicious code in mpesa-ui-components (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in mpesa-ui-components (npm)

The package communicates with a domain associated with malicious activity...

CVE-2025-8353

UI synchronization issue in the Just-in-Time JIT access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing...

CVE-2025-8353

UI synchronization issue in the Just-in-Time JIT access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing...

CVE-2025-8353

UI synchronization issue in the Just-in-Time JIT access request approval interface in Devolutions Server 2025.2.4.0 and earlier allows a remote authenticated attacker to gain unauthorized access to deleted JIT Groups via stale UI state during standard checkout request processing...

CVE-2025-8353

The CVE-2025-8353 entry concerns a UI synchronization issue in Devolutions Server (JIT) that affects versions prior to and including 2025.2.4.0. A remote authenticated attacker could exploit stale UI state during standard checkout processing to gain unauthorized access to deleted JIT Groups. Affe...

Malicious Package

Overview exceljs-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

Malicious code in exceljs-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 542e79c60c18aa779332620c884952b318f885c798a0ac8c2d3bf87bfad26950 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6361 Malicious code in exceljs-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 542e79c60c18aa779332620c884952b318f885c798a0ac8c2d3bf87bfad26950 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-43228

The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar spoofing...

PT-2025-31415 · Devolutions · Devolutions Server

Name of the Vulnerable Software and Affected Versions: Devolutions Server versions prior to 2025.2.4.0 Description: A UI synchronization issue exists in the Just-in-Time JIT access request approval interface. This issue allows a remote authenticated attacker to gain unauthorized access to deleted...

RockyLinux 9 : thunderbird (RLSA-2025:7435)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2025:7435 advisory. thunderbird: User Interface UI Misrepresentation of attachment URL CVE-2025-3523 thunderbird: Information Disclosure of /tmp directory listing...

CVE-2025-43228

The issue was addressed with improved UI. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6. Visiting a malicious website may lead to address bar spoofing...

CVE-2025-8191

A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the...

Cross-site Scripting (XSS)

Overview @fluentui/react-charts is a React web chart controls for Microsoft fluentui v9 system. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the unsecured SVG attribute spreading in the CartesianChart, Legend Shape renderer, and LineChart event annotation Textb...

Exploit for CVE-2025-8191

CVE-2025-8191 – Swagger UI XSS Injection Description :...

CVE-2025-8191

A vulnerability, which was classified as problematic, was found in macrozheng mall up to 1.0.3. Affected is an unknown function of the file /swagger-ui/index.html of the component Swagger UI. The manipulation of the argument configUrl leads to cross site scripting. It is possible to launch the...