16904 matches found
MAL-2025-42287 Malicious code in @crabas0npm/iste-a-provident-error (npm)
The package @crabas0npm/iste-a-provident-error was found to contain malicious code...
MAL-2025-42713 Malicious code in @taktikorg/molestiae-a-non (npm)
The package @taktikorg/molestiae-a-non was found to contain malicious code...
MAL-2025-43310 Malicious code in @zalastax/nolb-lion-a (npm)
The package @zalastax/nolb-lion-a was found to contain malicious code...
MAL-2025-42585 Malicious code in @hishprorg/quasi-a-voluptatum (npm)
The package @hishprorg/quasi-a-voluptatum was found to contain malicious code...
Malicious code in @zalastax/nolb-_types_a (npm)
The package @zalastax/nolb-typesa was found to contain malicious code...
TAG-150 Develops CastleRAT in Python and C, Expanding CastleLoader Malware Operations
The threat actor behind the malware-as-a-service MaaS framework and loader called CastleLoader has also developed a remote access trojan known as CastleRAT. "Available in both Python and C variants, CastleRAT's core functionality consists of collecting system information, downloading and executin...
CVE-2023-21479
Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a schedule...
PT-2025-36252
Name of the Vulnerable Software and Affected Versions: fullworks Quick Paypal Payments versions through 5.7.46 Description: The software contains a Cross-Site Request Forgery CSRF flaw. This issue allows attackers to perform actions on behalf of authenticated users. Recommendations: fullworks Qui...
CVE-2025-26454
In validateUriSchemeAndPermission of DisclaimersParserImpl.java , there is a possible way to access data from another user due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
CVE-2025-36896
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106...
CVE-2025-36896: Improper Privilege Management
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-394765106...
CVE-2025-36901: Improper Privilege Management
WLAN in Android before 2025-09-05 on Google Pixel devices allows elevation of privilege, aka A-396462223...
CVE-2023-21479
Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a schedule...
CVE-2023-21479
CVE-2023-21479 affects Samsung/Android devices due to an improper authorization weakness in Smart suggestions. The issue allows remote attackers to register a schedule on affected builds. Affected software includes Android 13 prior to SMR Apr-2023 Release 1 and Android 12 with 4.1.01.0. Remediati...
CVE-2025-58626: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in RumbleTalk RumbleTalk Live Group Chat rumbletalk-chat-a-chat-with-themes allows Stored XSS.This issue affects RumbleTalk Live Group Chat: from n/a through = 6.3.5...
CVE-2023-21479: Undefined Security Weakness
Improper authorization in Smart suggestions prior to SMR Apr-2023 Release 1 in Android 13 and 4.1.01.0 in Android 12 allows remote attackers to register a schedule...
CVE-2025-52548 Enabling SSH and Shellinabox on the vulnerable machine
E3 Site Supervisor Control firmware version 2.31F01 contains a hidden API call in the application services that enables SSH and Shellinabox, which exist but are disabled by default. An attacker with admin access to the application services can utilize this API to enable remote access to the...
Linux Distros Unpatched Vulnerability : CVE-2018-1043
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Moodle 3.x, the setting for blocked hosts list can be bypassed with multiple A record hostnames. CVE-2018-1043 Note that Nessus relies on the presence of the...
Linux Distros Unpatched Vulnerability : CVE-2024-53427
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - decNumberCopy in decNumber.c in jq through 1.7.1 does not properly consider that NaN is interpreted as numeric, which has a resultant stack-based buffer overflo...