CVE-2025-67504 WBCE CMS has Weak Random Number Generator in Password Generation Function

WBCE CMS is a content management system. Versions 1.6.4 and below use function GenerateRandomPassword to create passwords using PHP's rand. rand is not cryptographically secure, which allows password sequences to be predicted or brute-forced. This can lead to user account compromise or privilege...

UBUNTU-CVE-2023-53792

In the Linux kernel, the following vulnerability has been resolved: nvme-core: fix memory leak in dhchapctrlsecret Free dhchapsecret in nvmectrldhchapctrlsecretstore before we return when nvmeauthgeneratekey returns error...

CVE-2025-60912: Cross-Site Request Forgery (CSRF)

phpIPAM v1.7.3 contains a Cross-Site Request Forgery CSRF vulnerability in the database export functionality. The generate-mysql.php function, located in the /app/admin/import-export/ endpoint, allows remote attackers to trigger large database dump downloads via crafted HTTP GET requests if an...

Cross-site Scripting (XSS)

mailgen is vulnerable to Cross-site Scripting XSS. The vulnerability is due to improper sanitization in the generatePlaintext method, which fails to remove HTML tags provided as encoded entities, allowing an attacker to inject malicious HTML or JavaScript that can execute when the resulting...

PT-2025-48589

Name of the Vulnerable Software and Affected Versions Tencent MedicalNet affected versions not specified Description A flaw exists within the generate model function that allows remote attackers to execute arbitrary code on affected installations of Tencent MedicalNet. The issue stems from...

NULL Pointer Dereference

Overview Affected versions of this package are vulnerable to NULL Pointer Dereference via the coapdtlsgeneratecookie function. An attacker can cause the application to crash by sending a specially crafted DTLS handshake that results in SSLgetSSLCTX returning NULL. Remediation Upgrade libcoap to...

CVE-2025-65500

NULL pointer dereference in coapdtlsgeneratecookie in src/coapopenssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSLgetSSLCTX to return NULL...

CVE-2025-65496

NULL pointer dereference in coapdtlsgeneratecookie in src/coapopenssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSLgetSSLCTX to return NULL...

CVE-2025-65500

NULL pointer dereference in coapdtlsgeneratecookie in src/coapopenssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSLgetSSLCTX to return NULL...

CVE-2025-65500

NULL pointer dereference in coapdtlsgeneratecookie in src/coapopenssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSLgetSSLCTX to return NULL...

CVE-2025-65496

NULL pointer dereference in coapdtlsgeneratecookie in src/coapopenssl.c in OISM libcoap 4.3.5 allows remote attackers to cause a denial of service via a crafted DTLS handshake that triggers SSLgetSSLCTX to return NULL...

JLSEC-2025-215 In Mbed TLS before 2.28.0 and 3.x before 3.1.0, `psa_cipher_generate_iv` and `psa_cipher_encrypt`...

In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psaciphergenerateiv and psacipherencrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...

PT-2025-48514

In Mbed TLS before 3.1.0, psa aead generate nonce allows policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...

PT-2025-48513

In Mbed TLS before 2.28.0 and 3.x before 3.1.0, psa cipher generate iv and psa cipher encrypt allow policy bypass or oracle-based decryption when the output buffer is at memory locations accessible to an untrusted application...

Malicious code in primatology-impulse-decoherence-standard (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58284e42bf4777ae90b372bb825073354f20b88b702efc139f25470f6e037fc0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in schema-dependencies-paleoanthropology-xenos (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0a5aa35035cef2c1cc6c6bdb74528d86c9297519b890f65258d575cbc34a28f3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in spawn-miranda-publish-galaxy (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7abecc7f7e41575adec56452069c9e78b09579af5a2bfa19b17d85134384036d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189771 Malicious code in superposition-brane-gravity-altair (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d9c82c048bb292bb73d9d46a6684296f3b4daf92daf54aa70d1879d885c4731 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-52331

Cross-site scripting XSS vulnerability in the generate report functionality in Rarlab WinRAR 7.11, allows attackers to disclose user information such as the computer username, generated report directory, and IP address. The generate report command includes archived file names without validation i...

Malicious code in lobac-ubb-afayorg (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eb11352d602079c3f4e272e7ea2d13acac1dc71557d9a5b66cfbe4b9ae90cb66 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...