CGA-6FGF-RV4V-PC23

Bulletin has no description...

SAP NetWeaver AS ABAP Missing Authorization Check (3643337)

Due to a missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker with basic privileges could execute a specific function module in ABAP to retrieve restricted technical information from the system. This disclosure of environment details of the system...

Cloudlog security vulnerabilities

Cloudlog is a self-hosted PHP application by the individual developer Peter Goodhall. Allows logging of amateur radio contacts from anywhere. A security vulnerability exists in Cloudlog 2.7.5 and earlier versions that stems from the vuccdetailsajax function in Awards.php not properly cleaning up...

PT-2025-47009

Name of the Vulnerable Software and Affected Versions Cloudlog versions 2.7.5 and earlier Description An authenticated SQL injection issue exists. The vucc details ajax function within the application/controllers/Awards.php file does not properly sanitize the Gridsquare POST parameter provided by...

CVE-2025-64084

Cloudlog versions 2.7.5 and earlier are susceptible to an authenticated SQL injection vulnerability. The root cause is the vucc_details_ajax function in application/controllers/Awards.php, which fails to properly sanitize the user-supplied Gridsquare POST parameter. This allows a remote, authenti...

CVE-2025-64084

An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vuccdetailsajax function in application/controllers/Awards.php does not properly sanitize the user-supplied Gridsquare POST parameter. This allows a remote, authenticated attacker to execute arbitrary SQL...

CVE-2025-64084

An authenticated SQL injection vulnerability exists in Cloudlog 2.7.5 and earlier. The vuccdetailsajax function in application/controllers/Awards.php does not properly sanitize the user-supplied Gridsquare POST parameter. This allows a remote, authenticated attacker to execute arbitrary SQL...

GHSA-6CQF-CFHV-659G File Browser is Vulnerable to Insecure Direct Object Reference (IDOR) in Share Deletion Function

Summary It has been found an Insecure Direct Object Reference IDOR vulnerability in the FileBrowser application's share deletion functionality. This vulnerability allows any authenticated user with share permissions to delete other users' shared links without authorization checks. The impact is...

EUVD-2025-169290

A security flaw has been discovered in macrozheng mall-swarm up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the attack...

CVE-2025-13115 macrozheng mall-swarm/mall Order Details detail improper authorization

A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the...

CVE-2025-13115

CVE-2025-13115 affects macrozheng mall-swarm (and mall up to v1.0.3) in the Order Details Handler, specifically the /order/detail/ function. The issue arises from manipulating the orderId parameter, leading to improper authorization. Reported as exploitable remotely, with public exploitation avai...

CVE-2025-40179

In the Linux kernel, the following vulnerability has been resolved: ext4: verify orphan file size is not too big In principle orphan file can be arbitrarily large. However orphan replay needs to traverse it all and we also pin all its buffers in memory. Thus filesystems with absurdly large orphan...

Malicious code in zephyr-yakutsk-update-fornax (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4056139ea2e6931e54f1dbb6be8565d9c94ad19a8e4cc44520c8df7a00ac25f8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-185418 Malicious code in aldebaran-phoebe-sagitta-brane (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cbccf5241e22a7f267e4d1fbfd23724cc4e61b5fb81683a3f249f5614a147ddb This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-13115: Improper Authorization

A security flaw has been discovered in macrozheng mall-swarm and mall up to 1.0.3. This impacts the function detail of the file /order/detail/ of the component Order Details Handler. Performing manipulation of the argument orderId results in improper authorization. It is possible to initiate the...

PT-2025-46827

Name of the Vulnerable Software and Affected Versions macrozheng mall-swarm versions up to 1.0.3 macrozheng mall versions up to 1.0.3 Description A security flaw exists due to improper authorization when manipulating the orderId argument in the function detail of the Order Details Handler...

MAL-2025-184253 Malicious code in modiov-khan-afind (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ca6152d2a4fb9f3a2e6436c5a724e9d05c7bbe7964f106e47b9b9b592bc572a3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176614 Malicious code in nuilva-avmiam-rvo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 48e4f55282ac8c6728fd65312ac4db8b0543baa2aa07e73b9624c58224f1c950 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-176763 Malicious code in nuilva-daerde-oaalif (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a58f4313ea308ae524749c7fc45e88150d5395fd9ed1a99426d370a1548247b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in teagood-nalikami49 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bebc0b7bbac0fc873a4f73db52b1ed9f35cec636964862586f26386fe03c8fe7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...