Mediawiki - Monaco Skin 安全漏洞

Mediawiki - Monaco Skin is an open source appearance plugin for Mediawiki. A security vulnerability exists in Mediawiki - Monaco Skin versions 1.45, 1.44, 1.43, and 1.39, which stems from improper input neutralization and could lead to a cross-site scripting attack...

BIT-DISCOURSE-2025-64528 Users are able to find users by name even when `enable_names` is off

Discourse is an open source discussion platform. Prior to versions 3.5.3, 2025.11.1, and 2025.12.0, an attacker who knows part of a username can find the user and their full name via UI or API, even when enablenames is disabled. Versions 3.5.3, 2025.11.1, and 2025.12.0 contain a fix...

CVE-2025-68455 Craft CMS vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior

Craft is a platform for creating digital experiences. Versions 5.0.0-RC1 through 5.8.20 and 4.0.0-RC1 through 4.16.16 are vulnerable to potential authenticated Remote Code Execution via malicious attached Behavior. Note that attackers must have administrator access to the Craft Control Panel for...

firefox: thunderbird: JIT miscompilation in the JavaScript Engine: JIT component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: JIT miscompilation in the JavaScript Engine: JIT component...

Security Bulletin: IBM i is affected by a cross-site scripting vulnerability in Navigator for i [CVE-2024-47875]

Summary Navigator for IBM i is vulnerable to cross-site scripting when using the browser editor CVE-2024-47875 as described in the vulnerability details section. Vulnerability Details CVEID:CVE-2024-47875 DESCRIPTION: DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, Math...

GHSA-Q66G-Q98C-Q454 Mattermost has missing redirect URL validation

Mattermost versions 10.11.x = 10.11.4 fail to validate redirect URLs on the /error page, which allows an attacker to redirect a victim to a malicious site via a crafted link opened in a new tab...

firefox: thunderbird: Same-origin policy bypass in the Request Handling component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Same-origin policy bypass in the Request Handling component...

Coder sensitive objects logged unsanitized vulnerability (CVE-2025-66411)

The Coder versions prior to 2.26.5, 2.27.7, and 2.28.4 are therefore vulnerable to a sensitive information disclosure via plaintext logging. Workspace Agent manifests containing sensitive values were logged in plaintext unsanitized. An attacker with limited local access to the Coder Workspace VM,...

Mozilla Firefox和Mozilla Firefox ESR 安全漏洞

Mozilla Firefox and Mozilla Firefox ESR are both products of the Mozilla Foundation, U.S.A. Mozilla Firefox is an open source web browser.Mozilla Firefox ESR is an extended support version of Firefox web browser. A security vulnerability exists in Mozilla Firefox versions prior to 146 and Firefox...

UBUNTU-CVE-2025-66420

Tryton sao aka tryton-sao before 7.6.9 allows XSS via an HTML attachment. This is fixed in 7.6.9, 7.4.19, 7.0.38, and 6.0.67...

CVE-2025-66421

Tryton sao aka tryton-sao before 7.6.11 allows XSS because it does not escape completion values. This is fixed in 7.6.11, 7.4.21, 7.0.40, and 6.0.69...

CVE-2025-54561

An Incorrect Access Control vulnerability was found in the Application Server of Desktop Alert PingAlert version 6.1.0.11 to 6.1.1.2 which allows remote access to content despite lack of the correct permission through a Broken Authorization Schema...

Malicious code in ophiuchus-bootstrap-perseus-airbnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 165a8447356cfc0b4e1e5b701577bcb27e3f4cdfad04226d333dcb610673e901 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in cordelia-websockets-yakutsk-quark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d647c58f0a661436c26cd8beb4a3828948c14da4a4c99f2bbe55d3e02b0c14e5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in easy-serialize-omicron-mu-assert (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 69139970a915ceb4235e38acc7b982f8685dd4a844c2ea07bc4144d8a42be7b4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nightmare-mesosphere-iota-dotenv (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2277b8efd1d670698357ef4928cfdeebcbaf96d247814a668af92fe7f157f8e4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in enum-report-char-rho-alpha (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75fe47f9adba20f092284e704a6a5619427390e0fff83d48dab8122cbd9ecac6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in meteor-betelgeuse-eigenstate-cladistics (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f97a2bdd138f7da883f74cc7c6a1ebdc9aac6a3457ba9d28a1b30c92106cdf1d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in astrochemistry-selenium-solis-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e4945f4be5d41b84b61b8cdf7c141ff4cbd2a35808590735d6fda40200ddd8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in higgs-biosignature-inflation-upgrade (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f6af5f94c074749c796605831b304d3b23f9cd7ecd27b0771334f6c877a95bf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...