8149 matches found
PT-2026-5600
A vulnerability was determined in EFM ipTIME A8004T 14.18.2. Affected is the function httpcon check session url of the file /sess-bin/d.cgi of the component Debug Interface. This manipulation of the argument cmd causes backdoor. It is possible to initiate the attack remotely. The complexity of an...
Keycloak < 26.4.4 Debug Mode JDWP Port Exposure (CVE-2025-11538)
The version of Keycloak installed on the remote host is prior to 26.4.4. It is, therefore, affected by a Port Exposure vulnerability: - A vulnerability exists in Keycloak's server distribution where enabling debug mode --debug insecurely defaults to binding the Java Debug Wire Protocol JDWP port ...
GHSA-VG9H-JX4V-CWX2 Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Summary The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.rundebug=..., so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default. Details - unfurl/app.py:weba...
Unfurl's debug mode cannot be disabled due to string config parsing (Werkzeug debugger exposure)
Summary The Unfurl web app enables Flask debug mode even when configuration sets debug = False. The config value is read as a string and passed directly to app.rundebug=..., so any non-empty string evaluates truthy. This leaves the Werkzeug debugger active by default. Details - unfurl/app.py:weba...
Active Debug Code
Overview dfir-unfurl is an Unfurl takes a URL and expands "unfurls" it into a directed graph Affected versions of this package are vulnerable to Active Debug Code due to improper parsing of the debug configuration value, which is always interpreted as truthy and enables the Werkzeug debugger...
Malicious Package
Overview debug-fmt is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...
Malicious code in debug-fmt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 049bf4db6a598df3cc4db93a71b765670e9b94be0c835ae183fd91c13fe99d8b The package debug-fmt was found to contain malicious code. Source: ghsa-malware 1f7e76c50ec40bd53847463f61469ebfb4691c221c290d98fed82736214216cc Any...
Malicious code in debug-glitz (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f09a7eab8b255c9470cf181542b2ed5b9b214602d0c73dc089938cc1a2d546b2 The package debug-glitz was found to contain malicious code. Source: ghsa-malware 5c2a809411c1675d6b31e695ec844e233dbcc14e9c576f30d6e3491084b5b90c An...
MAL-2026-566 Malicious code in debug-fmt (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 049bf4db6a598df3cc4db93a71b765670e9b94be0c835ae183fd91c13fe99d8b The package debug-fmt was found to contain malicious code. Source: ghsa-malware 1f7e76c50ec40bd53847463f61469ebfb4691c221c290d98fed82736214216cc Any...
MAL-2026-567 Malicious code in debug-glitz (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f09a7eab8b255c9470cf181542b2ed5b9b214602d0c73dc089938cc1a2d546b2 The package debug-glitz was found to contain malicious code. Source: ghsa-malware 5c2a809411c1675d6b31e695ec844e233dbcc14e9c576f30d6e3491084b5b90c An...
CVE-2025-59104
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint or use the 6-Pin tag-connect cable. Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through...
CLSA-2026-1769506462 Fix CVE(s): CVE-2025-8225
SECURITY UPDATE: debuginformation memory leak in processdebuginfo - debian/patches/CVE-2025-8225.patch: prevent memory leak by checking allocnumdebuginfoentries instead of numdebuginfoentries to determine whether debuginformation has been allocated - CVE-2025-8225...
AZL-75464 CVE-2026-24809 affecting package memcached for versions less than 1.6.27-4
An issue from the component luaGrunerror in dependencies/lua/src/ldebug.c in praydog/REFramework version before 1.5.5 leads to a heap-buffer overflow when a recursive error occurs...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005014)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005014 advisory. In the Linux kernel, the following vulnerability has been resolved: smb: client: fix use-after-free bug in cifsdebugdataprocshow Skip SMB sessions that are being...
Unity Linux 20.1050e Security Update: kernel (UTSA-2026-005152)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-005152 advisory. In the Linux kernel, the following vulnerability has been resolved: ext4: avoid use-after-free in ext4extshowleaf In ext4findextent, path may be freed by error or be...
sonarcloud-poc
SonarCloud PoC - SAST Test Projeto de teste para validar dete...
CVE-2025-59104
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint or use the 6-Pin tag-connect cable. Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through...
CVE-2025-59104
The CVE-2025-59104 issue affects a dormakaba access manager where an attacker with physical access can solder to the debug footprint or connect a 6-Pin tag‑connect cable to access the bootloader. The vulnerable vector allows changing the kernel command line and ultimately obtaining a root shell. ...
CVE-2025-59104
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint or use the 6-Pin tag-connect cable. Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through...
EUVD-2025-206371
With physical access to the device and enough time an attacker is able to solder test leads to the debug footprint or use the 6-Pin tag-connect cable. Thus, the attacker gains access to the bootloader, where the kernel command line can be changed. An attacker is able to gain a root shell through...