April 10, 2025, update for Office 2016 (KB5002623)

None None...

MAL-2025-3083 Malicious code in servicecore-response-handler (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efae7348c792464442a5508d7cd2907cd55c01835e4cc188b1e078b1b96beadc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yxt-fe-center (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eefdd1eb0ce0a6fc7fac81b2bf725420903465a02f853bddcce53bb22c9463ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sf-intl-sn-prod (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb4cc33212e001bc0af0440f49eb0c52cdc0ad223eba555c5cb2afaa9931e5c3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2668 Malicious code in elm-lang-http (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d5eb3c2ea771ad8d786241ffd33fd3345d71c3a00d5aa6a053d81034de8ebd4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-9919

A missing authentication check in the uninstall endpoint of parisneo/lollms-webui V13 allows attackers to perform unauthorized directory deletions. The /uninstall/appname API endpoint does not call the checkaccess function to verify the clientid, enabling attackers to delete directories without...

CVE-2024-9919

The CVE-2024-9919 issue affects parisneo/lollms-webui version 13, specifically the uninstall endpoint. A missing authentication check in /uninstall/{app_name} means the server does not call check_access() to verify client_id, allowing unauthorized directory deletions. The vulnerability is describ...

LoLLMs Web UI 安全漏洞

LoLLMs Web UI is a web user interface for large languages and multimodal systems by the individual developer Saifeddine ALOUI. A security vulnerability exists in LoLLMs Web UI version V12, which stems from the install and uninstall API endpoints not being adequately cleaned of user input,...

CVE-2025-1666

The Cookie banner plugin for WordPress – Cookiebot CMP by Usercentrics plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the senduninstallsurvey function in all versions up to, and including, 4.4.1. This makes it possible for authenticate...

MAL-2025-2171 Malicious code in fastapi.py (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c591ed328da145b399af78111c309d609f9c1036b092eb17c774f9428b367207 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-9084 · WordPress · The Nextmove Lite – Thank You Page For Woocommerce

Name of the Vulnerable Software and Affected Versions: NextMove Lite – Thank You Page for WooCommerce plugin for WordPress versions up to, and including, 2.19.0 Description: The issue arises from a missing capability check on the submit uninstall reason action function, allowing authenticated...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the failure to properly handle the aedev node when uninstalling drivers in parallel, which could lead to a...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from xfrm not removing intermediate secpath entries in package uninstall mode...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from the vmbus driver not properly logging out of the panic notifier during module uninstallation, which could le...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from a driver uninstallation without logging off the platform device, which can be exploited by an attacker to...

GNU GRUB 资源管理错误漏洞

GNU GRUB is a Linux system boot program from the GNU community. A resource management error vulnerability exists in GNU GRUB, which originates from a module uninstallation without clearing hooks, and can be exploited by an attacker to initiate a large number of requests, consuming system resource...

Malicious code in telegram-bot-host (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7bfce13be8a817c4f8165b600702f49df73736a44741857d560aab26bfa00162 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerabilities have been resolved: net: hns3: fixed a kernel crash that occurred when uninstalling the driver When the driver is uninstalled and the VFs are disabled concurrently, a kernel crash occurs. The reason is that both actions call the function...

CVE-2024-23457

The anti-tampering functionality of the Zscaler Client Connector can be disabled under certain conditions when an uninstall password is enforced. This affects Zscaler Client Connector on Windows prior to 4.2.0.209...

CVE-2024-43769

In isPackageDeviceAdmin of PackageManagerService.java, there is a possible edge case which could prevent the uninstallation of CloudDpc due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed...