4257 matches found
EUVD-2025-36858
Malicious code in jsx-a11y npm...
New Android Trojan 'Herodotus' Outsmarts Anti-Fraud Systems by Typing Like a Human
Cybersecurity researchers have disclosed details of a new Android banking trojan called Herodotus that has been observed in active campaigns targeting Italy and Brazil to conduct device takeover DTO attacks. "Herodotus is designed to perform device takeover while making first attempts to mimic...
New Android Trojan 'Herodotus' Outsmarts Anti-Fraud Systems by Typing Like a Human
Cybersecurity researchers have disclosed details of a new Android banking trojan called Herodotus that has been observed in active campaigns targeting Italy and Brazil to conduct device takeover DTO attacks. "Herodotus is designed to perform device takeover while making first attempts to mimic...
CVE-2025-49920
Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through = 2.10...
EUVD-2025-35538
Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through = 2.10...
CVE-2025-49920 WordPress Web Accessibility By accessiBe plugin <= 2.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through = 2.10...
PT-2025-43184
Name of the Vulnerable Software and Affected Versions accessiBe Web Accessibility versions prior to and including 2.10 Description A missing authorization issue exists in accessiBe Web Accessibility. The issue involves exploiting incorrectly configured access control security levels...
CVE-2025-49920: Missing Authorization
Missing Authorization vulnerability in accessiBe Web Accessibility By accessiBe accessibe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Web Accessibility By accessiBe: from n/a through = 2.10...
The vulnerability of the opj_jp2_read_header function in the OpenJPEG library allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the opjjp2readheader function in the OpenJPEG image encoding and decoding library is related to the use of an uninitialized variable. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the protected...
The vulnerability of the Claude Code tool, related to incorrect restrictions on the path name to the restricted access catalog, allows attackers to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Claude Code code editor is related to an incorrect restriction on the path name to the restricted access catalog. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...
The vulnerability of the Consilium Safety CS5000 Fire Panel allows a intruder to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the Consilium Safety CS5000 Fire Pane control panel is related to an unsafe initialization of resources. Exploiting this vulnerability could allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected information...
CVE-2025-10700: Cross-Site Request Forgery (CSRF)
The Ally – Web Accessibility & Usability plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the enableunfilteredfilesupload function. This makes it possible for unauthenticated...
PT-2025-42403
Name of the Vulnerable Software and Affected Versions Ally – Web Accessibility & Usability plugin for WordPress versions prior to 3.8.1 Description The Ally – Web Accessibility & Usability plugin for WordPress is susceptible to Cross-Site Request Forgery. This is caused by inadequate nonce...
How Blind and Low-Vision Users Manage Their Passwords
Managing passwords securely and conveniently is still an open problem for many users. Existing research has examined users' password management strategies and identified pain points, such as security concerns, leading to insecure practices. We investigate how Blind and Low-Vision BLV users tackle...
The vulnerability of the tf.keras.layers.Embedding interface in the TensorFlow machine learning system allows attackers to compromise the integrity and accessibility of the protected information.
The vulnerability of the tf.keras.layers.Embedding layer in the TensorFlow machine learning system is related to the presence of undeclared capabilities during the processing of the inputdim argument. Exploiting this vulnerability could allow attackers to compromise the integrity and accessibilit...
WordPress Web Accessibility By accessiBe plugin <= 2.10 - Cross-Site Request Forgery vulnerability
Cross-Site Request Forgery vulnerability discovered by Moose Love in WordPress Plugin Web Accessibility By accessiBe versions = 2.10...
The vulnerability of the `bnxt_re_remove()` function in the drivers/infiniband/hw/bnxt_re/main.c file of the Linux kernel’s InfiniBand driver allows a attacker to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the bnxtreremove function in the drivers/infiniband/hw/bnxtre/main.c file of the Linux kernel’s InfiniBand driver is related to the re-use of previously released memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...
CVE-2025-10375: Cross-Site Request Forgery (CSRF)
The Web Accessibility By accessiBe plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10. This is due to missing nonce validation on multiple AJAX actions including accessibesignup, accessibelogin, accessibelicensetrial, accessibemodifyconfig,...
The vulnerability of open-source development environments for UEFI EDK2 lies in the violation of data protection mechanisms, allowing attackers to compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of open-source development environments for UEFI EDK2 is related to a breach of data protection mechanisms. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of protected information...