Improper Authentication

Overview Affected versions of this package are vulnerable to Improper Authentication via the Manager web UI endpoints /api/v1/jobs and /preheats. An attacker can gain unauthorized access to create, delete, or modify jobs, and initiate preheat jobs by sending unauthenticated requests to these...

CVE-2025-59345

CVE-2025-59345 affects Dragonfly (open source P2P file distribution/image acceleration). Before version 2.1.0, the Manager web UI endpoints /api/v1/jobs and /preheats were accessible without authentication, allowing any user with network access to create, delete, and modify jobs and to create pre...

PT-2025-38253

Name of the Vulnerable Software and Affected Versions Dragonfly versions prior to 2.1.0 Description The /api/v1/jobs and /preheats endpoints in the Manager web UI are accessible without authentication. An unauthenticated adversary with network access to a Manager web UI can create, delete, and...

CVE-2025-59345: Missing Authentication for Critical Function

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create...

Dragonfly doesn't have authentication enabled for some Manager’s endpoints

The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create preheat jobs. An unauthenticated adversary with network access to a Manager web UI uses /api/v1/jobs endpoi...

Malicious Package

Overview nf-web-ui is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

@cosla/sensemaking-web-ui (>=1.0.0, <=1.0.4) potentially affected by CVE-2025-59052 via @angular/ssr (18.2.13)

@angular/ssr NPM version 18.2.13 is affected by a known vulnerability. The following packages have a transitive dependency on @angular/ssr and may be impacted: - @cosla/sensemaking-web-ui =1.0.0, =1.0.4 Source cves: CVE-2025-59052 Source advisory: SNYK:JS-ANGULARSSR-12613576...

Linux Distros Unpatched Vulnerability : CVE-2022-30034

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Flower, a web UI for the Celery Python RPC framework, all versions as of 05-02-2022 is vulnerable to an OAuth authentication bypass. An attacker could then acce...

GHSA-PC6W-59FV-RH23 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2025-6984 vulnerabilities

Vulnerabilities for packages: open-webui...

CVE-2025-57539

A stored cross-site scripting XSS vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment PVE 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially...

CVE-2025-57539: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment PVE 8.4 allows authenticated users to store malicious input. The payload is rendered unsafely in the Web UI and executed when viewed by other users, potentially...

CVE-2025-36125: Improper Neutralization of Input During Web Page Generation

IBM Hardware Management Console - Power 10.3.1050.0 and 11.1.1110.0 is vulnerable to stored cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure...

CVE-2025-57539

A stored cross-site scripting (XSS) vulnerability exists in the U2F Origin field of the Datacenter configuration in Proxmox Virtual Environment (PVE) 8.4 . Authenticated users can store malicious input that is rendered unsafely in the Web UI , leading to execution when viewed by other users. This...

Web-Application-Vulnerability-scanner

Web-Application-Vulnerability-scanner A Python...

CVE-2025-2694: Improper Neutralization of Input During Web Page Generation

IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.71 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.71 and 6.2.0.0 through 6.2.0.4 is vulnerable to cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI...

CVE-2024-43184: Improper Neutralization of Input During Web Page Generation

IBM Jazz Foundation 7.0.2 through 7.0.2 iFix033, 7.0.3 through 7.0.3 iFix012, and 7.1.0 through 7.1.0 iFix002 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality...

Malicious code in nf-web-ui (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9daed61da73f36e121e5335edee0f392a2a0f1ee89890f0589974f04ff0f1c9 Any computer that has this package installed or running should be considered...

MAL-2025-45306 Malicious code in nf-web-ui (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9daed61da73f36e121e5335edee0f392a2a0f1ee89890f0589974f04ff0f1c9 Any computer that has this package installed or running should be considered...

CVE-2025-33083

IBM Concert Software 1.0.0 through 1.1.0 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...