9951 matches found
VulnCheck KEV: CVE-2025-28137
The TOTOLINK A810R V4.1.2cu.5182B20201026 were found to contain a pre-auth remote command execution vulnerability in the setNoticeCfg function through the NoticeUrl parameter...
CVE-2024-13973: Improper Neutralization of Special Elements used in an SQL Command
A post-auth SQL injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR1 21.0.1 can potentially lead to administrators achieving arbitrary code execution...
CVE-2025-7382: Improper Neutralization of Special Elements used in an OS Command
A command injection vulnerability in WebAdmin of Sophos Firewall versions older than 21.0 MR2 21.0.2 can lead to adjacent attackers achieving pre-auth code execution on High Availability HA auxiliary devices, if OTP authentication for the admin user is enabled...
Malicious code in ipp-auth-service-tools (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54b42b5695779161ac5d3618b146cd263b9f17a9c1fe517abd5efff7b3ecdc97 Any computer that has this package installed or running should be considered...
MAL-2025-6099 Malicious code in ipp-auth-service-tools (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 54b42b5695779161ac5d3618b146cd263b9f17a9c1fe517abd5efff7b3ecdc97 Any computer that has this package installed or running should be considered...
CVE-2025-54064 rucio-server, rucio-ui, and rucio-webui vulnerable to insertion of X-Rucio-Auth-Token in apache access logfiles
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The common Rucio helm-charts for the rucio-server, rucio-ui, and rucio-webui define the log format for the apache access log of these components...
CVE-2025-54064
CVE-2025-54064 affects Rucio helm charts for rucio-server, rucio-ui, and rucio-webui. The Apache access-log format includes the X-Rucio-Auth-Token header (which may contain Internal Rucio tokens or JWTs), potentially exposing credentials in log lines. Affected versions and patches: rucio-server 3...
Malicious code in preview-server-auth-poc (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923e18277dc972e221ab7a161e65c18219ff037b3a347b86f86df7f6cba1bcfb The OpenSSF Package Analysis project identified...
MAL-2025-5993 Malicious code in preview-server-auth-poc (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 923e18277dc972e221ab7a161e65c18219ff037b3a347b86f86df7f6cba1bcfb The OpenSSF Package Analysis project identified...
CVE-2025-54064: Insertion of Sensitive Information into Log File
Rucio is a software framework that provides functionality to organize, manage, and access large volumes of scientific data using customizable policies. The common Rucio helm-charts for the rucio-server, rucio-ui, and rucio-webui define the log format for the apache access log of these components...
Rucio Helm Charts 日志信息泄露漏洞
Rucio Helm Charts is a library for Rucio in the rucio open source. Rucio Helm Charts suffers from a log message disclosure vulnerability that stems from logging X-Rucio-Auth-Token, which could lead to credential disclosure...
MAL-2025-5971 Malicious code in vss-web-auth-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70dc7c0837db09d1f3b1d98483b9ce346b56d8ea5ae46ee6b2d974d8be75ea26 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in ado-codespaces-auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acd2e4a00a6fa99e47e9f10ae7238f2faaf2dd65d07678a4f33037a25ef636c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-50103: Uncontrolled Resource Consumption
Vulnerability in the MySQL Server product of Oracle MySQL component: Server: Security: LDAP Auth. Supported versions that are affected are 9.0.0-9.3.0. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server...
Malicious code in @subsplash/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 689eb4db6c52e3ce55d130f22da039b110c816b7a03395db966a87086272fd42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-5859 Malicious code in @subsplash/auth (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 689eb4db6c52e3ce55d130f22da039b110c816b7a03395db966a87086272fd42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-6089 Malicious code in fxa-auth-server (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 001dcafa5fa85d6d5358a1a79909f92615e17cae27329f2b1fea9c1cc51d41ca Any computer that has this package installed or running should be considered...
CVE-2025-53668
Jenkins VAddy Plugin 1.2.8 and earlier stores Vaddy API Auth Keys unencrypted in job config.xml files on the Jenkins controller, where they can be viewed by users with Item/Extended Read permission or access to the Jenkins controller file system...