Siemens SICAM Q100/Q200 Cleartext Storage of Sensitive Information (CVE-2025-40753)

Affected devices export the password for the SMTP account as plain text in the Configuration File. This could allow an authenticated local attacker to extract it and use the configured SMTP service for arbitrary purposes. This plugin only works with Tenable.ot. Please visit...

CVE-2025-9982

A vulnerability exists in QuickCMS version 6.8 where sensitive admin credentials are hardcoded in a configuration file and stored in plaintext. This flaw allows attackers with access to the source code or the server file system to retrieve authentication details, potentially leading to privilege...

CVE-2016-15056 Ubee EVW3226 Unauthenticated Backup File Disclosure

Ubee EVW3226 cable modem/routers firmware versions up to and including 1.0.20 store configuration backup files in the web root after they are generated for download. These backup files remain accessible without authentication until the next reboot. A remote attacker on the local network can reque...

Malicious code in double-uglify-long-static-cron (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 86cbddf969fda2c0a80a2252a875d61720e0aa7aa2b2a5725fd102e01d1f0c6c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

EUVD-2025-176671

Malicious code in resolvers-superflare-chalk-ini npm...

Malicious code in pulsar-crust-acamar-technosignature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca5355cbd68aac1da711412886e7e3a77b66c193fddd4cfb2ff2a0ed9e7726b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185859 Malicious code in blitz-materialize-link-lint-staged (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cd6558b44eec2954b20bb99ebb1a7e8e455149631179d6949c5569bd11e1822 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-189700 Malicious code in string-route-theta-virtualize-deserialize (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9f524d85f0a7b09046d1a72ea16b5cc85abad3d62c1dd280310cc3d9a4917907 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185922 Malicious code in buffer-mocha-astrophysics-technosignature (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c19bdb6e5591367013f268343f1513dad33fc681f85b2aef30be47ec269cb5a1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-60675

CVE-2025-60675 affects D-Link DIR-823G router (firmware DIR823G_V1.0.2B05_20181207.bin). The vulnerability is in the timelycheck and sysconf binaries that parse /tmp/new_qos.rule; fields are concatenated into command strings and executed via system() without sanitization. An attacker with write a...

CVE-2025-60675

A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823GV1.0.2B0520181207.bin in the timelycheck and sysconf binaries, which process the /tmp/newqos.rule configuration file. The vulnerability occurs because parsed fields from the configuration file are concatenated...

CVE-2025-60675

A command injection vulnerability exists in the D-Link DIR-823G router firmware DIR823GV1.0.2B0520181207.bin in the timelycheck and sysconf binaries, which process the /tmp/newqos.rule configuration file. The vulnerability occurs because parsed fields from the configuration file are concatenated...

Malicious code in mahnu-oy-giossisi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8da78aea58ec22d8ef0e2a79c63c6b333f98c79c5588c3d378f8ea4dcaaa0a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183307 Malicious code in ksut-agg-ibifua (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 771ba25adc0d410d27fc9f1fc406646e5a7b862637f2aa53d3c319617d310b47 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in manu-oyi-gioafisoi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e948acc55ead6175abd00658e2d85ccc65c79f1940193cbcb0069b08771f731e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-183206 Malicious code in kisut-dfg-diwfzcfecdavgcab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe2f0339a81ec818e29743546170ff2d8688a53ed7edfb06ea9d65fb3bb0fd4b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2022-4983

TEC-IT TBarCode version 11.15 contains a vulnerability in the TBarCode11.ocx ActiveX/OCX control's licensing handling INI-file based that can be abused to cause remote creation of files on the host filesystem. Depending on where files can be created and which filenames are allowed, this can allow...

Malicious code in teate-thy-sonic-ruwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e399e0545c0d5f006d489ae19ef731633582db1198002ef614f653926b927b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in diva-banifobfo-imfaibai (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25b38d7569221c27a3a3440c8116e442a2adda3a2f66d61d723776c1d37030eb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in nuilva-dakdre-aodoanfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ad5aa6f0b089df28367ad39f3e348d36e3f939e9e97e6ff026f1289e51d265b1 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...