kafka-clients: privilege escalation to filesystem read-access via automatic ConfigProvider

A flaw was found in Apache Kafka Clients. Apache Kafka Clients accepts configuration data for customizing behavior and includes ConfigProvider plugins to manipulate these configurations. Apache Kafka also provides FileConfigProvider, DirectoryConfigProvider, and EnvVarConfigProvider...

Malicious Package

Overview notification-clients is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in notification-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23bcd1ac33ef0a2bf3c93c92420613bb1f50bfe66ca2893e94643ba662eeded6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6367 Malicious code in notification-clients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23bcd1ac33ef0a2bf3c93c92420613bb1f50bfe66ca2893e94643ba662eeded6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-6505

Unauthorized access and impersonation can occur in versions 4.6.2.3226 and below of Progress Software's Hybrid Data Pipeline Server on Linux. This vulnerability allows attackers to combine credentials from different sources, potentially leading to client impersonation and unauthorized access. Whe...

Zoom Clients Cross-Site Scripting Vulnerability

Zoom Clients is a multi-platform video conferencing client application developed by Zoom Inc. for video conferencing, online collaboration and other functions. A cross-site scripting vulnerability exists in Zoom Clients, which can be exploited by attackers to cause information leakage...

CVE-2025-37104

A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQL Injection attack when sending a service request, and potentially exfiltrate the database's vendor name to unauthorized authenticated...

[SECURITY] Fedora 41 Update: minidlna-1.3.3-10.fc41

MiniDLNA aka ReadyDLNA is server software with the aim of being fully compliant with DLNA/UPnP-AV clients. The minidlna daemon serves media files music, pictures, and video to clients on your local network. Example clients include applications such as Totem and XBMC, and devices such as portable...

[SECURITY] Fedora 42 Update: minidlna-1.3.3-13.fc42

MiniDLNA aka ReadyDLNA is server software with the aim of being fully compliant with DLNA/UPnP-AV clients. The minidlna daemon serves media files music, pictures, and video to clients on your local network. Example clients include applications such as Totem and XBMC, and devices such as portable...

Unbreakable Enterprise kernel security update

6.12.0-101.33.4.3 - Revert 'Add normal counters' Boris Ostrovsky Orabug: 38171405 6.12.0-101.33.4.2 - sunrpc: handle SVCGARBAGE during svc auth processing as auth error Jeff Layton Orabug: 38178286 CVE-2025-38089 - mm: memcontrol: remove memcg from LRU on release instead of offline Harry Yoo...

CVE-2025-37104

A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQL Injection attack when sending a service request, and potentially exfiltrate the database's vendor name to unauthorized authenticated...

CVE-2025-37104 HPE Telco Service Orchestrator Software, Authenticated SQL Injection

A security vulnerability has been identified in HPE Telco Service Orchestrator software. The vulnerability could allow authenticated clients to to perform a SQL Injection attack when sending a service request, and potentially exfiltrate the database's vendor name to unauthorized authenticated...

CVE-2025-37104

The CVE concerns HPE Telco Service Orchestrator. It describes an authenticated SQL Injection vulnerability in service requests that could allow exfiltration of the database vendor name to authorized authenticated clients. Affected software is HPE Telco Service Orchestrator; the specific vulnerabl...

CLSA-2025-1752655009 java-1.8.0-openjdk: Fix of 7 CVEs

CVE-2024-20952: remote data access or modification in sandboxed clients - CVE-2024-20932: modify or access sensitive data in sandboxed client environments - CVE-2024-20918: remote data access or modification in sandboxed clients - CVE-2024-20926: remote data access in sandboxed clients -...

PT-2025-29828 · Hewlett Packard · Hpe Telco Service Orchestrator

Name of the Vulnerable Software and Affected Versions: HPE Telco Service Orchestrator affected versions not specified Description: A security issue exists in HPE Telco Service Orchestrator software that could allow authenticated clients to perform a SQL Injection attack when sending a service...

Oracle Linux 8 / 9 : Unbreakable Enterprise kernel (ELSA-2025-20470)

The remote Oracle Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2025-20470 advisory. - sunrpc: handle SVCGARBAGE during svc auth processing as auth error Jeff Layton CVE-2025-38089 - netsched: schsfq: move the limit validation...

CVE-2025-49463

Insufficient control flow management in certain Zoom Clients for iOS before version 6.4.5 may allow an unauthenticated user to conduct a disclosure of information via network access...

CVE-2025-49464

Classic buffer overflow in certain Zoom Clients for Windows may allow an authorised user to conduct a denial of service via network access...

CVE-2025-46789

Classic buffer overflow in certain Zoom Clients for Windows may allow an authorized user to conduct a denial of service via network access...

Apache HTTP Server 2.4.35 < 2.4.64 Access Control Bypass Vulnerability - Windows

Apache HTTP Server is prone to an access control bypass vulnerability in modssl. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...