CVE-2025-13953 Bypass in the authentication method of the GTT Sistema de Información Tributario application

Bypass vulnerability in the authentication method in the GTT Tax Information System application, related to the Active Directory LDAP login method. Authentication is performed through a local WebSocket, but the web application does not properly validate the authenticity or origin of the data...

CVE-2025-13953

CVE-2025-13953 describes a bypass of the authentication method in the GTT Tax Information System (GTT Sistema de Información Tributario) due to improper validation of data received over a local WebSocket used for LDAP-based login. The root cause is insufficient verification of authenticity/origin...

CVE-2023-53801

In the Linux kernel, the following vulnerability has been resolved: iommu/sprd: Release dma buffer to avoid memory leak When attaching to a domain, the driver would alloc a DMA buffer which is used to store address mapping table, and it need to be released when the IOMMU domain is freed...

CVE-2023-53789

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Improve page fault error reporting If IOMMU domain for device group is not setup properly then we may hit IOMMU page fault. Current page fault handler assumes that domain is always setup and it will hit NULL pointer...

MAL-2025-192423 Malicious code in vue2-amis-custom-widget-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c676b8d3fdeb2773313404ba039b4e2162b5e516e6938db609188c352f319cc8 The package vue2-amis-custom-widget-pro was found to contain malicious code. Source: ghsa-malware...

Malicious code in vue2-amis-custom-widget-pro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c676b8d3fdeb2773313404ba039b4e2162b5e516e6938db609188c352f319cc8 The package vue2-amis-custom-widget-pro was found to contain malicious code. Source: ghsa-malware...

Exploit for Improper Access Control in Microsoft

🔧 CVE-2025-33073 - Simple Tool for Easy Exploitation 🚀 Get...

Malicious code in near-fast-auth-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ca901df252a441f9253e1a56812e262f6c7282f53587866710310fa282394c The package near-fast-auth-signer was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192420 Malicious code in near-fast-auth-signer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85ca901df252a441f9253e1a56812e262f6c7282f53587866710310fa282394c The package near-fast-auth-signer was found to contain malicious code. Source: ghsa-malware...

Malicious code in vue2-amis-custom-widget123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027b467c811b36f60dc7589ccd8251ffc56de7f40345d6a471a3a550a2a8df7e The package vue2-amis-custom-widget123 was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-192421 Malicious code in vue2-amis-custom-widget123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 027b467c811b36f60dc7589ccd8251ffc56de7f40345d6a471a3a550a2a8df7e The package vue2-amis-custom-widget123 was found to contain malicious code. Source: ossf-package-analysis...

SUSE CVE-2022-50645

In the Linux kernel, the following vulnerability has been resolved: EDAC/i10nm: fix refcount leak in pcigetdevwrapper As the comment of pcigetdomainbusandslot says, it returns a PCI device with refcount incremented, so it doesn't need to call an extra pcidevget in pcigetdevwrapper, and the PCI...

SUSE CVE-2023-53789

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Improve page fault error reporting If IOMMU domain for device group is not setup properly then we may hit IOMMU page fault. Current page fault handler assumes that domain is always setup and it will hit NULL pointer...

SUSE CVE-2023-53801

In the Linux kernel, the following vulnerability has been resolved: iommu/sprd: Release dma buffer to avoid memory leak When attaching to a domain, the driver would alloc a DMA buffer which is used to store address mapping table, and it need to be released when the IOMMU domain is freed...

Aqara多款产品 安全漏洞

Aqara Camera Hub G3 and others are a smart surveillance camera from Aqara USA. A security vulnerability exists in various Aqara products, which stems from a malicious domain name that results in command injection, which could lead to the execution of arbitrary commands. The following products and...

CVE-2025-65292

CVE-2025-65292 describes a command-injection vulnerability in Aqara Hub devices: Camera Hub G3 (4.1.9_0027), Hub M2 (4.3.6_0027), and Hub M3 (4.3.6_0025). The root cause is command injection via malicious domain names, enabling an attacker with local access and low privileges to run commands with...

Malicious GenAI Chrome Extensions: Unpacking Data Exfiltration and Malicious Behaviours

The rapid proliferation of AI and GenAI tools has extended to the Chrome Web Store. Cybercriminals are exploiting this trend, deploying malicious Chrome extensions posing as AI tools or impersonating popular GenAI models to target users. These extensions often appear legitimate while secretly...

CVE-2025-65292

Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.90027, Hub M2 4.3.60027, and Hub M3 4.3.60025 allows attackers to execute arbitrary commands with root privileges through malicious domain names...

CVE-2025-65827

The mobile application is configured to allow clear text traffic to all domains and communicates with an API server over HTTP. As a result, an adversary located "upstream" can intercept the traffic, inspect its contents, and modify the requests in transit. TThis may result in a total compromise o...

CVE-2025-65292

Command injection vulnerability in Aqara Hub devices including Camera Hub G3 4.1.90027, Hub M2 4.3.60027, and Hub M3 4.3.60025 allows attackers to execute arbitrary commands with root privileges through malicious domain names...