CVE-2025-34320

BASIS BBj versions prior to 25.00 contain a Jetty-served web endpoint that fails to properly validate or canonicalize input path segments. This allows unauthenticated directory traversal sequences to cause the server to read arbitrary system files accessible to the account running the service...

CVE-2025-33119

IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user...

CVE-2025-33119 IBM QRadar SIEM Information Disclosure

IBM QRadar SIEM 7.5 through 7.5.0 UP14 stores user credentials in configuration files in source control which can be read by an authenticated user...

CVE-2025-33119

CVE-2025-33119 affects IBM QRadar SIEM versions 7.5 through 7.5.0 UP14. The underlying issue is the improper storage of credentials in configuration files within source control, which an authenticated user can read, leading to potential credential disclosure. The CVSS base score is 6.5 (Medium) w...

Malicious code in teagood-cuekin74 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b348d730122e00dc6b39ebddd6f8e926d0912591d3c45d2623ddeea6fda003f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in indus-astro-materialize-miranda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8474eedfb266d52c3e1dfc1fb588e3b8fd8b8541a1b2a946c7249acdde5c6458 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in test-schema-dione-leda (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3af9e6c2b2b4d710d8a1f6df5d2630dad09faaf289798dc90e320c66da0f8106 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

PT-2025-46718

Name of the Vulnerable Software and Affected Versions IBM QRadar SIEM versions 7.5 through 7.5.0 UP14 Description IBM QRadar SIEM versions 7.5 through 7.5.0 UP14 stores user credentials in configuration files within source control. An authenticated user can read these credentials. Recommendations...

Malicious code in lutfi-lodeh2-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 71788aaeb5e3c3a4219aae73127b1f28fbf5033d771af9b311b19b282abeb131 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-102537 Malicious code in fajar-soto88-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6c9ff83b8789a3dd38b8fe62df7b60bef13801883f8257d359aa43899e32b80 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-111425 Malicious code in zain-mendut57-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d82825ffa318239d9ef93a73fc1fdd5d3fd7203b62e7a1461091be8439a96b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-94537 Malicious code in flat_badger_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf6a490d05df3b5a9b8fe448e8f55b0054b69128eaa412c500e2d4940213900f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in ade-menjes97-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 682e37192de8bd4f19c780b207d10af919dcd4ad6bf274901f81d1e0ae6c950e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

AXIS OS 安全漏洞

AXIS OS is an edge device operating system from Axis Sweden. AXIS OS has a security vulnerability that stems from insufficient validation of ACAP configuration file inputs, which could lead to path traversal attacks and elevation of privilege...

CVE-2025-64321

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0...

PT-2025-45389

Name of the Vulnerable Software and Affected Versions affected versions not specified Description A flaw exists due to inadequate input sanitization when processing configuration files. An attacker can upload a crafted configuration file to cause a denial-of-service condition, traverse directorie...

Lexmark Printers Path Traversal (CVE-2021-44737)

PJL directory traversal vulnerability in Lexmark devices through 2021-12-07 that can be leveraged to overwrite internal configuration files. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc...

CVE-2025-64321

Improper Neutralization of Input Used for LLM Prompting vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0...

CVE-2025-64319

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Mulesoft Anypoint Code Builder allows Manipulating Writeable Configuration Files.This issue affects Mulesoft Anypoint Code Builder: before 1.12.1...

CVE-2025-64322

Incorrect Permission Assignment for Critical Resource vulnerability in Salesforce Agentforce Vibes Extension allows Manipulating Writeable Configuration Files.This issue affects Agentforce Vibes Extension: before 3.3.0...