Sync-in Server: SSRF protection bypass via IPv4-mapped IPv6 addresses in regExpPrivateIP

Summary: The private IP blocklist regex used in the URL download feature does not match IPv4-mapped IPv6 addresses e.g. ::ffff:127.0.0.1, allowing SSRF protection to be bypassed on dual-stack systems. Affected components backend/src/applications/files/services/files-manager.service.ts –...

CVE-2025-66357

CHOCO TEI WATCHER mini IB-MCT001 contains an issue with improper check for unusual or exceptional conditions. When the Video Download feature is in a specific communication state, the product's resources may be consumed abnormally...

CVE-2025-66357

CHOCO TEI WATCHER mini IB-MCT001 contains an issue with improper check for unusual or exceptional conditions. When the Video Download feature is in a specific communication state, the product's resources may be consumed abnormally...

CVE-2025-66357

CHOCO TEI WATCHER mini IB-MCT001 contains an issue with improper check for unusual or exceptional conditions. When the Video Download feature is in a specific communication state, the product's resources may be consumed abnormally...

CVE-2025-66357

Summary: CVE-2025-66357 affects CHOCO TEI WATCHER mini (IB-MCT001). When the Video Download feature is in a specific communication state, the product may consume resources abnormally due to an improper check for unusual or exceptional conditions, potentially causing a denial of service. The Red H...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in Google Chrome prior to version 143.0.7499.41, which stems from an improper implementation of the download feature and could lead to UI spoofing by a local attacker via a specially crafted HTML page...

Google Chrome 安全漏洞

Google Chrome is a web browser from Google, Inc USA. A security vulnerability exists in versions of Google Chrome prior to 140.0.7339.80, which stems from an improper implementation of the download feature and could lead to a bypass of Mark of the Web...

Improper Authorization

TYPO3 CMS is vulnerable to Improper Authorization. The vulnerability is due to missing authorization checks in the CSV download feature, which allows an attacker to disclose information from arbitrary database tables within a user’s web mounts without having proper access...

EUVD-2021-19016

Malware in sbrugna...

EUVD-2010-3656

Malware in sbrugna...

EUVD-2020-20705

Malware in sbrugna...

EUVD-2021-19017

Malware in sbrugna...

EUVD-2024-50520

Malicious code in bioql PyPI...

CVE-2023-41629

A lack of input sanitizing in the file download feature of eSST Monitoring v2.147.1 allows attackers to execute a path traversal...

CVE-2021-32158

A Cross-Site Scripting XSS vulnerability exists in Webmin 1.973 via the Upload and Download feature...

CVE-2021-32159

A Cross-site request forgery CSRF vulnerability exists in Webmin 1.973 via the Upload and Download feature...

NLTK Security Vulnerabilities

NLTK is a natural language toolkit. It is used to support research and development in natural language processing. A security vulnerability exists in NLTK version 3.8.1 and prior versions, which stems from a vulnerability that could lead to remote code execution if the integrated packet download...

Fortinet FortiPortal SQL Injection Vulnerability

Fortinet FortiPortal is an advanced, feature-rich hosted security analysis and management support tool for Fortinet's FortiGate, FortiWiFi, and FortiAP product lines, available as a virtual machine for MSPs. A SQL injection vulnerability exists in Fortinet FortiPortal versions 7.0.0 through 7.0.6...

CVE-2022-48584

A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system...

CVE-2022-48584

A command injection vulnerability exists in the download and convert report feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a shell command. This allows for the injection of arbitrary commands to the underlying operating system...