Use of Hard-coded Password

Overview Affected versions of this package are vulnerable to Use of Hard-coded Password via the NewToken function. An attacker can gain unauthorized access to sensitive information by exploiting the use of a hard-coded password in the JSON Web Token handling process. Remediation There is no fixed...

Nextcloud: Deck app allowed user with "Can share" permission to modify permissions of other non-owners

The Deck app in Nextcloud allowed users with "Can share" permission to modify the permissions of other non-owners...

Marvell QConvergeConsole path traversal vulnerability (CNVD-2025-20445)

Marvell QConvergeConsole is a unified adapter management software across data centers from Marvell USA. A path traversal vulnerability exists in Marvell QConvergeConsole due to an error in the getAppFileBytes method. An attacker could exploit the vulnerability to disclose information in the SYSTE...

Marvell QConvergeConsole Path Traversal Vulnerability (CNVD-2025-20443)

Marvell QConvergeConsole is a unified adapter management software across data centers from Marvell USA. A path traversal vulnerability exists in Marvell QConvergeConsole due to an error in the deleteAppFile method. An attacker could exploit the vulnerability to delete a file in the SYSTEM context...

📄 The Language Sloth Web Application 1.0 Cross Site Scripting

The Language Sloth Web Application version 1.0 suffers from a cross site scripting vulnerability. CVE-2025-45778 CVE-2025-45778: Authenticated Stored XSS. An authenticated stored cross-site scripting XSS vulnerability in The Language Sloth Web Application v1.0 allows attackers to execute arbitrar...

CVE-2025-31267

An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information...

CVE-2025-31267

An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information...

CVE-2025-31267

CVE-2025-31267 : Apple App Store Connect had an authentication issue caused by problematic state management. It could allow an attacker with physical access to an unlocked device to view sensitive user information. The issue is fixed in App Store Connect 3.0. Affected version: App Store Connect p...

CVE-2025-31267

An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information...

CVE-2025-31267

An authentication issue was addressed with improved state management. This issue is fixed in App Store Connect 3.0. An attacker with physical access to an unlocked device may be able to view sensitive user information...

SUSE-SU-2025:02280-1 Security update for tomcat

This update for tomcat fixes the following issues: - CVE-2025-46701: Fixed refactor CGI servlet to access resources via WebResources bsc1243815. - CVE-2025-48988: Fixed limits the total number of parts in a multi-part request and limits the size of the headers provided with each part bsc1244656. ...

CVE-2025-53545

Press, a Frappe custom app that runs Frappe Cloud, manages infrastructure, subscription, marketplace, and software-as-a-service SaaS. Users can circumvent 2FA login for users due to a lack of server side validation for the same. This vulnerability is fixed in commit...

New ZuRu Malware Variant Targeting Developers via Trojanized Termius macOS App

Cybersecurity researchers have discovered new artifacts associated with an Apple macOS malware called ZuRu, which is known to propagate via trojanized versions of legitimate software. SentinelOne, in a new report shared with The Hacker News, said the malware has been observed masquerading as the...

Malicious code in tv-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware addb927c8910ec93507080bad17c52b12df866249c823ceb79970bda06bc74d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mitigating CitrixBleed 2 (CVE‑2025‑5777) NetScaler Memory Disclosure with App & API Protector

...

CVE-2025-7206

creationtimestamp| type| source ---|---|--- 2025-07-10 04:45:35+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3ltljimnu6a2j 2025-07-11 15:39:22+00:00| seen| https://bsky.app/profile/thedailytechfeed.com/post/3ltp6ikclz22w...

CVE-2025-6438

creationtimestamp| type| source ---|---|--- 2025-07-10 01:48:46+00:00| seen| https://bsky.app/profile/jimbecher.bsky.social/post/3ltl7mhepzk2i 2025-07-22 10:00:00+00:00| seen| https://www.cisa.gov/news-events/ics-advisories/icsa-25-203-06...

PT-2025-29173 · Apple · App Store Connect

Name of the Vulnerable Software and Affected Versions: App Store Connect versions prior to 3.0 Description: An authentication issue existed due to improved state management. An attacker with physical access to an unlocked device may be able to view sensitive user information. Recommendations:...

Windows App Client < 2.0.559.0 RCE Vulnerability (Jul 2025) - Windows

Windows App Client is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Apple App Store Connect 安全漏洞

Apple App Store Connect is an Apple platform for developers to manage and distribute applications. A security vulnerability exists in Apple App Store Connect version 3.0, which stems from an authentication issue that could lead to the disclosure of sensitive user information...