MAL-2025-41385 Malicious code in gbb-kubernetes-hackfest-webui-dashboard (npm)

The package communicates with a domain associated with malicious activity...

📄 iDempiere WebUI 12.0.0.202508171158 Session Fixation

iDempiere WebUI version 12.0.0.202508171158 suffers from a session fixation vulnerability. The application does not issue a new session identifier JSESSIONID after successful authentication. An attacker who can set or predict a victim’s session ID prior to login may hijack the victim’s...

PT-2025-33848 · Ibm · Ibm Sterling File Gateway +1

Name of the Vulnerable Software and Affected Versions: IBM Sterling B2B Integrator version 6.2.1.0 IBM Sterling File Gateway version 6.2.1.0 Description: IBM Sterling B2B Integrator and IBM Sterling File Gateway are susceptible to a cross-site scripting issue. An authenticated user can embed...

PT-2025-33679 · Vaultls · Vaultls

Name of the Vulnerable Software and Affected Versions: VaulTLS versions prior to 0.9.1 Description: VaulTLS is a solution for managing mTLS mutual TLS certificates. User accounts created through the User web UI have an empty password set, allowing attackers to log in with a blank password...

Linux Distros Unpatched Vulnerability : CVE-2024-3958

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab CE/EE affecting all versions before 17.0.6, 17.1 prior to 17.1.4, and 17.2 prior to 17.2.2. An issue was found that allow...

Linux Distros Unpatched Vulnerability : CVE-2018-6070

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Lack of CSP enforcement on WebUI pages in Bink in Google Chrome prior to 65.0.3325.146 allowed an attacker who convinced a user to install a malicious extension...

CVE-2025-36088

IBM TS4500 1.11.0.0-D00, 1.11.0.1-C00, 1.11.0.2-C00, and 1.10.00-F00 web GUI is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosu...

CVE-2025-32932

An Improper neutralization of input during web page generation 'cross-site scripting' vulnerability CWE-79 in FortiSOAR version 7.6.1 and below, version 7.5.1 and below, 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions WEB UI may allow an authenticated remo...

MAL-2025-39386 Malicious code in wms-web-ui (npm)

The package wms-web-ui was found to contain malicious code...

CVE-2025-20306

A vulnerability in the web-based management interface of Cisco Secure Firewall Management Center FMC Software could allow an authenticated, remote attacker with Administrator-level privileges to execute arbitrary commands on the underlying operating system. This vulnerability is due to insufficie...

CVE-2025-20265 Cisco Secure Firewall Management Center Software Radius Remote Code Execution Vulnerability

A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center FMC Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. This vulnerability is due to a lack of proper handling of user input...

CVE-2025-36000

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with...

CVE-2025-36000

CVE-2025-36000 affects IBM WebSphere Application Server Liberty. The Connected IBM bulletin confirms Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting, allowing a privileged user to embed arbitrary JavaScript in the Web UI and potentially disclose credentials within a...

CVE-2025-36000 IBM WebSphere Application Server Liberty cross-site scripting

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with...

CVE-2025-36000 IBM WebSphere Application Server Liberty cross-site scripting

IBM WebSphere Application Server Liberty 17.0.0.3 through 25.0.0.8 is vulnerable to stored cross-site scripting. This vulnerability allows a privileged user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure with...

CVE-2025-32932

An Improper neutralization of input during web page generation 'cross-site scripting' vulnerability CWE-79 in FortiSOAR version 7.6.1 and below, version 7.5.1 and below, 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions WEB UI may allow an authenticated remo...

CVE-2025-32932

CVE-2025-32932 is an XSS vulnerability in FortiSOAR web UI caused by improper input neutralization (CWE-79). Affected are FortiSOAR versions 6.4 and all 7.x releases up to 7.6.1. The impact is stored XSS that can be triggered by authenticated remote attackers via stored malicious service requests...

CVE-2025-32932

An Improper neutralization of input during web page generation 'cross-site scripting' vulnerability CWE-79 in FortiSOAR version 7.6.1 and below, version 7.5.1 and below, 7.4 all versions, 7.3 all versions, 7.2 all versions, 7.0 all versions, 6.4 all versions WEB UI may allow an authenticated remo...

PT-2025-32887

Name of the Vulnerable Software and Affected Versions: IBM WebSphere Application Server Liberty versions 17.0.0.3 through 25.0.0.8 Description: IBM WebSphere Application Server Liberty is susceptible to stored cross-site scripting. A privileged user can embed arbitrary JavaScript code into the We...

Deserialization of Untrusted Data

Overview llamafactory is an Easy-to-use LLM fine-tuning framework Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the Checkpoint path parameter in the WebUI interface during the training process. An attacker can exploit this vulnerability by supplying a...