Microsoft Windows Hello 安全漏洞

Microsoft Windows Hello is a biometric-based login from Microsoft Corporation USA that allows you to sign in using your face, fingerprint or PIN. A security vulnerability exists in Microsoft Windows Hello. An attacker could exploit this vulnerability to gain elevated privileges. The following...

CVE-2023-50430

The Goodix Fingerprint Device, as shipped in Dell Inspiron 15 computers, does not follow the Secure Device Connection Protocol SDCP when enrolling via Linux, and accepts an unauthenticated configuration packet to select the Windows template database, which allows bypass of Windows Hello...

CVE-2021-28428

File upload vulnerability in HorizontCMS before 1.0.0-beta.3 via uploading a .htaccess and .hello files using the Media Files upload functionality. The original file upload vulnerability CVE-2020-27387 was remediated by restricting the PHP extensions; however, we confirmed that the filter was...

Malicious code in hello-world-npm-demo-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b3d59e455a083fe1d90b99dc29e2b1d207b769331e331fd1e01a28e2a1e7060 The package hello-world-npm-demo-example was found to contain malicious code. Source: ghsa-malware...

EUVD-2026-1141

Malicious code in hello-world-npm-demo-example npm...

MAL-2026-59 Malicious code in hello-world-npm-demo-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1b3d59e455a083fe1d90b99dc29e2b1d207b769331e331fd1e01a28e2a1e7060 The package hello-world-npm-demo-example was found to contain malicious code. Source: ghsa-malware...

OSV-2025-1049 Heap-buffer-overflow in unsigned char* std::__1::vector<unsigned char, std::__1::allocator<unsigned char

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=472222304 Crash type: Heap-buffer-overflow READ 1 Crash state: unsigned char std::1::vectorunsigned char, std::1::allocatorunsigned char pcpp::TLSECPointFormatExtension::getECPointFormatList...

EUVD-2025-203286

The HelloLeads CRM Form Shortcode WordPress plugin through 1.0 does not have authorisation and CSRF check when resetting its settings, allowing unauthenticated users to reset them...

CVE-2025-63095

Improper input validation in the BitstreamWriter::writebits function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-63095

Improper input validation in the BitstreamWriter::writebits function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a Denial of Service DoS via a crafted input...

Hello Video Codec 安全漏洞

Hello Video Codec is a video codec from Tempus Ex open source. A security vulnerability exists in Hello Video Codec version v0.1.0, which stems from improper validation of inputs to the BitstreamWriter::writebits function, which could lead to a denial of service attack...

CVE-2025-63095: Improper Input Validation

Improper input validation in the BitstreamWriter::writebits function of Tempus Ex hello-video-codec v0.1.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2025-63095

The Tempus Ex hello-video-codec version v0.1.0 is vulnerable to a Denial of Service (DoS) attack due to improper input validation in the BitstreamWriter::write_bits() function. An attacker can exploit this flaw by providing a crafted input . Remediation involves updating to a newer version that c...

PT-2025-48451

Name of the Vulnerable Software and Affected Versions Tempus Ex hello-video-codec version 0.1.0 Description A flaw exists in the BitstreamWriter::write bits function that allows for a Denial of Service DoS through crafted input due to improper input validation. Recommendations Update to a newer...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

CVE-2025-11936

Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to...

EUVD-2025-198524

Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to...

EUVD-2025-198525

Improper Input Validation in the TLS 1.3 CKS extension parsing in wolfSSL 5.8.2 and earlier on multiple platforms allows a remote unauthenticated attacker to potentially cause a denial-of-service via a crafted ClientHello message with duplicate CKS extensions...

EUVD-2025-198529

With TLS 1.3 pre-shared key PSK a malicious or faulty server could ignore the request for PFS perfect forward secrecy and the client would continue on with the connection using PSK without PFS. This happened when a server responded to a ClientHello containing pskdheke without a keyshare...

DEBIAN-CVE-2025-11936

Improper input validation in the TLS 1.3 KeyShareEntry parsing in wolfSSL v5.8.2 on multiple platforms allows a remote unauthenticated attacker to cause a denial-of-service by sending a crafted ClientHello message containing duplicate KeyShareEntry values for the same supported group, leading to...