CVE-2025-49183 Unencrypted communication (HTTP)

All communication with the REST API is unencrypted HTTP, allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files...

CVE-2025-49183 Unencrypted communication (HTTP)

All communication with the REST API is unencrypted HTTP, allowing an attacker to intercept traffic between an actor and the webserver. This leads to the possibility of information gathering and downloading media files...

CVE-2025-49183

CVE-2025-49183 affects SICK Field Analytics and SICK Media Server. Root cause: unencrypted REST API communications over HTTP allow an attacker to intercept traffic, enabling information gathering and potential media-file downloads. Impact is described as confidentiality concerns (information disc...

MAL-2025-4932 Malicious code in uniswap-v4-scratchpad-poc (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01754c5d133c195a4c109504b5db8355893e90a308a2317d421d8f2d034cad23 Any computer that has this package installed or running should be considered...

CVE-2025-35978

Improper restriction of communication channel to intended endpoints issue exists in UpdateNavi V1.4 L10 to L33 and UpdateNaviInstallService Service 1.2.0091 to 1.2.0125. If a local authenticated attacker send malicious data, an arbitrary registry value may be modified or arbitrary code may be...

Malicious code in sendgrid-bloodhound (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

PT-2025-25308

Name of the Vulnerable Software and Affected Versions The product name cannot be determined. Description The issue is related to unencrypted communication with the REST API, which uses HTTP. This allows an attacker to intercept traffic between the actor and the webserver, potentially leading to...

JVN#17860456: UpdateNavi vulnerable to improper restriction of communication channel to intended endpoints

UpdateNavi provided by Fujitsu Client Computing Limited contains the following vulnerability. Improper restriction of communication channel to intended endpoints CWE-923 CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N Base Score 6.9 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H Bas...

PT-2025-25282 · Unknown · Updatenaviinstallservice Service +1

Name of the Vulnerable Software and Affected Versions: UpdateNavi versions 1.4 L10 through 1.4 L33 UpdateNaviInstallService Service versions 1.2.0091 through 1.2.0125 Description: The issue exists due to improper restriction of communication channel to intended endpoints. If a local authenticated...

perl-fcgi: FCGI versions 0.44 through 0.82, for Perl, include a vulnerable version of the FastCGI fcgi2 (aka fcgi) library

A flaw was found in the FCGI library. In affected versions, specially crafted nameLen or valueLen values in data sent to the IPC socket may result in a heap-based buffer overflow, which can cause an application crash or other undefined behavior. This occurs in ReadParams in fcgiapp.c...

[SECURITY] Fedora 42 Update: qt6-qtremoteobjects-6.9.1-1.fc42

Qt Remote Objects QtRO is an inter-process communication IPC module devel oped for Qt...

CVE-2025-22251

An improper restriction of communication channel to intended endpoints vulnerability CWE-923 in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization...

CVE-2025-22251

FortiOS CVE-2025-22251: An improper restriction of the FGSP session synchronization channel allows an unauthenticated attacker to inject unauthorized sessions. Affected FortiOS versions are 7.6.0, 7.4.0–7.4.5, 7.2 all versions, 7.0 all versions, and 6.4 all versions. This CWE-923 issue can enable...

CVE-2025-22251

An improper restriction of communication channel to intended endpoints vulnerability CWE-923 in FortiOS 7.6.0, 7.4.0 through 7.4.5, 7.2 all versions, 7.0 all versions, 6.4 all versions may allow an unauthenticated attacker to inject unauthorized sessions via crafted FGSP session synchronization...

Malicious code in vite-plugin-esm-federation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1f7926dff38c759aa63ad9b55035d541c0512f6796681961dcd734e4d77cacc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Stash ws.stash.app.mac.daemon.helper 安全漏洞

Stash ws.stash.app.mac.daemon.helper is a system agent component for macOS by Stash. A security vulnerability exists in Stash ws.stash.app.mac.daemon.helper, which stems from an incorrect use of the macOS authorization model, and could allow an unauthorized client to invoke privileged operations...

Fortinet FortiOS 安全漏洞

Fortinet FortiOS is a set of security operating systems dedicated to the FortiGate network security platform from the U.S. company Fiat Fortinet. The system provides users with firewall, antivirus, IPSec/SSLVPN, Web content filtering and anti-spam and other security features. A security...

PT-2025-38699

Name of the Vulnerable Software and Affected Versions Lightspeed affected versions not specified Description A flaw exists in the Lightspeed history service due to insufficient access controls. A local, unprivileged user can access and manipulate the chat history of another user on the same syste...

On the Ethics of Using LLMs for Offensive Security

Large Language Models LLMs have rapidly evolved over the past few years and are currently evaluated for their efficacy within the domain of offensive cyber-security. While initial forays showcase the potential of LLMs to enhance security research, they also raise critical ethical concerns regardi...

CVE-2025-49140

Pion Interceptor is a framework for building RTP/RTCP communication software. Versions v0.1.36 through v0.1.38 contain a bug in a RTP packet factory that can be exploited to trigger a panic with Pion based SFU via crafted RTP packets, This only affect users that use pion/interceptor. Users should...