PT-2025-46179

Name of the Vulnerable Software and Affected Versions Tenda AX-3 version 16.03.12.10 CN Description The Tenda AX-3 device contains a stack overflow issue through the shareSpeed parameter within the fromSetWifiGusetBasic function. A crafted request can lead to a Denial of Service DoS...

Malware in @basic-ui-components-stc/basic-ui-components

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

security-guide-for-developers

This is a security guide for web developers, covering various security topics such as authentication, authorization, data validation, and encryption. The guide is divided into several sections, including a security checklist, authentication and authorization, data validation and sanitation, and...

CVE-2025-59573: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in CozyThemes Cozy Blocks cozy-addons allows Code Injection.This issue affects Cozy Blocks: from n/a through = 2.1.29...

D-Link DIR-825 Router Code Execution

The vulnerability of the setbasicapi function in D-Link DIR-825 router software lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows an attacker to execute arbitrary code by sending a specially crafted POST request...

wifi: cfg80211: fix use-after-free in cmp_bss()

...

"Digital Camouflage": the LLVM Challenge in LLM-Based Malware Detection

Large Language Models LLMs have emerged as promising tools for malware detection by analyzing code semantics, identifying vulnerabilities, and adapting to evolving threats. However, their reliability under adversarial compiler-level obfuscation is yet to be discovered. In this study, we empirical...

SUSE-SU-2025:03261-1 Security update for cups

This update for cups fixes the following issues: - CVE-2024-47175: no validation of IPP attributes in ppdCreatePPDFromIPP2 when writing to a temporary PPD file allows for the injection of attacker-controlled data to the resulting PPD bsc1230932. - CVE-2025-58060: no password check when AuthType i...

Dragonfly vulnerable to timing attacks against Proxy’s basic authentication

Impact The access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison...

net.masterthought.jenkins:cucumber-reports (>=1.3.0, <=2.5.1), org.jenkins-ci.main:jenkins-test-harness (1.577) +21 more potentially affected by CVE-2025-59476 via org.jenkins-ci.main:jenkins-core (1.577)

org.jenkins-ci.main:jenkins-core MAVEN version 1.577 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - net.masterthought.jenkins:cucumber-reports =1.3.0, =2.5.1 -...

br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin (>=0.3.7, <=0.3.15), com.cloudbees.jenkins.plugins:amazon-ecr (1.6) +27 more potentially affected by CVE-2025-59475 via org.jenkins-ci.main:jenkins-core (1.642.1)

org.jenkins-ci.main:jenkins-core MAVEN version 1.642.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - br.com.ingenieux.jenkins.plugins:awseb-deployment-plugin =0.3.7, =2.0.0, =1.0, =1.3.1, =1.6.0...

MAL-2025-47420 Malicious code in @basic-ui-components-stc/basic-ui-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0c7cc4b06e4071b6e4613358e926ea521ee3acb2223670ed3783c57abb5c0567 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE SLES15: erlang-rabbitmq-client313 / rabbitmq-server313 / etc (SUSE-SU-2025:03234-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:03234-1 advisory. - CVE-2025-50200: Fixed logging of Basic Auth header from an HTTP request bsc1245105 - Fixed bad logrotate configuration...

Dragonfly vulnerable to timing attacks against Proxy’s basic authentication

The access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time by sending all possible characters to a vulnerable mechanism and measuring the comparison instruction’...

[SECURITY] Fedora 42 Update: perl-Catalyst-Authentication-Credential-HTTP-1.019-1.fc42

This module lets you use HTTP authentication with Catalyst::Plugin::Authentication. Both basic and digest authentication are currently supported...

Security update for rabbitmq-server313

This update for rabbitmq-server313 fixes the following issues: CVE-2025-50200: Fixed logging of Basic Auth header from an HTTP request bsc1245105 Fixed bad logrotate configuration allowing potential escalation from rabbitmq to root bsc1246091 Patch Instructions: To install this SUSE update use th...

Malware in basic-validator-pro

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious Package

Overview basic-pump-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in basic-pump-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc10b9f2bba8789f982dedfa26ff72ba0c4149b11d522b1d60523fac65c58419 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47175 Malicious code in basic-validator-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a065e2ce3dcaa4245e9bd8873e7878385dbe7a3fe9aa7276ae5ac89686209889 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...