Malware in sechub-web-ui

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-5873

A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the file /firmware.php of the component Web UI. Performing a manipulation of the argument media results in unrestricted upload. The attack can be initiated remotely...

CVE-2025-5873

CVE-2025-5873 affects the eCharge Hardy Barth Salia PLCC Web UI, with the vulnerable code path in the /firmware.php file. The issue arises from improper handling of the media parameter, allowing unrestricted file upload and enabling remote exploitation. Public exploit details exist, and multiple ...

CVE-2025-5873 eCharge Hardy Barth Salia PLCC Web UI firmware.php unrestricted upload

A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the file /firmware.php of the component Web UI. Performing a manipulation of the argument media results in unrestricted upload. The attack can be initiated remotely...

CVE-2025-5873: Unrestricted Upload of File with Dangerous Type

A vulnerability was detected in eCharge Hardy Barth Salia PLCC up to 2.3.81. Affected by this issue is some unknown functionality of the file /firmware.php of the component Web UI. Performing a manipulation of the argument media results in unrestricted upload. The attack can be initiated remotely...

PT-2025-24421

Name of the Vulnerable Software and Affected Versions eCharge Hardy Barth Salia PLCC version 2.2.0 Description A critical issue affects the Web UI component, specifically the /firmware.php file, allowing for unrestricted upload by manipulating the media argument. This can be initiated remotely. T...

Malicious code in sechub-web-ui (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f65f37c0cf500f985994b4ab4d2cc764e8072e70cc17aab91987e239129fa93 Any computer that has this package installed or running should be considered...

MAL-2025-4764 Malicious code in sechub-web-ui (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f65f37c0cf500f985994b4ab4d2cc764e8072e70cc17aab91987e239129fa93 Any computer that has this package installed or running should be considered...

CVE-2025-2896 IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-2896

IBM Planning Analytics Local (versions 2.0 and 2.1) is affected by a cross-site scripting vulnerability in the Web UI that an authenticated user can exploit to inject arbitrary JavaScript, potentially leaking credentials within a trusted session. Affected products/versions: IBM Planning Analytics...

CVE-2025-25044 IBM Planning Analytics Local cross-site scripting

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-25044

CVE-2025-25044 affects IBM Planning Analytics Local (2.0 and 2.1). The vulnerability is cross-site scripting in the Web UI that allows an authenticated user to embed arbitrary JavaScript, potentially leading to credentials disclosure within a trusted session. Affected products are IBM Planning An...

CVE-2025-25044: Improper Neutralization of Input During Web Page Generation

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2025-2896: Improper Neutralization of Input During Web Page Generation

IBM Planning Analytics Local 2.0 and 2.1 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

PT-2025-23423 · Ibm · Ibm Planning Analytics Local

Name of the Vulnerable Software and Affected Versions: IBM Planning Analytics Local versions 2.0 through 2.1 Description: The issue allows an authenticated user to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to credentials disclosure...

CVE-2024-45094

CVE-2024-45094 affects IBM DS8900F and DS8A00 Hardware Management Console (HMC): stored cross-site scripting in the Web UI could let a privileged user inject arbitrary JavaScript, potentially leading to credential disclosure within a trusted session. IBM notes remediation via firmware/microcode u...

PT-2025-23042 · Ibm · Ibm Ds8900F +1

Name of the Vulnerable Software and Affected Versions: IBM DS8900F and DS8A00 Hardware Management Console HMC affected versions not specified Description: The issue concerns stored cross-site scripting, allowing a privileged user to embed arbitrary JavaScript code in the Web UI. This could alter...

PT-2025-22886 · Pepperl+Fuchs · Profinet Gateway Fb8122A.1.El +1

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: Due to improper neutralization of input during web page generation, an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device. Recommendations: At the...

CVE-2025-1985: Improper Neutralization of Input During Web Page Generation

Due to improper neutralization of input during web page generation XSS an unauthenticated remote attacker can inject HTML code into the Web-UI in the affected device...

CVE-2024-20414

A vulnerability in the web UI feature of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to conduct a cross-site request forgery CSRF attack on an affected system through the web UI. This vulnerability is due to incorrectly accepting configuration...