507 matches found
EUVD-2025-29771
Malicious code in bioql PyPI...
EUVD-2025-29768
Malicious code in bioql PyPI...
EUVD-2025-29770
Malicious code in bioql PyPI...
EUVD-2025-29775
Malicious code in bioql PyPI...
EUVD-2025-29777
Malicious code in bioql PyPI...
SUSE CVE-2025-59345
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, The /api/v1/jobs and /preheats endpoints in Manager web UI are accessible without authentication. Any user with network access to the Manager can create, delete, and modify jobs, and create...
SUSE CVE-2025-59346
Dragonfly is an open source P2P-based file distribution and image acceleration system. Versions prior to 2.1.0 contain a server-side request forgery SSRF vulnerability that enables users to force DragonFly2's components to make requests to internal services that are otherwise not accessible to...
SUSE CVE-2025-59348
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the processPieceFromSource method does not update the structure's usedTraffic field, because an uninitialized variable n is used as a guard to the AddTraffic method call, instead of the...
SUSE CVE-2025-59349
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, DragonFly2 uses the os.MkdirAll function to create certain directory paths with specific access permissions. This function does not perform any permission checks when a given directory path...
SUSE CVE-2025-59350
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the access control mechanism for the Proxy feature uses simple string comparisons and is therefore vulnerable to timing attacks. An attacker may try to guess the password one character at a time...
SUSE CVE-2025-59351
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the first return value of a function is dereferenced even when the function returns an error. This can result in a nil dereference, and cause code to panic. This vulnerability is fixed in 2.1.0...
SUSE CVE-2025-59352
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal...
SUSE CVE-2025-59354
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the DragonFly2 uses a variety of hash functions, including the MD5 hash, for downloaded files. This allows attackers to replace files with malicious ones that have a colliding hash. This...
SUSE CVE-2025-59410
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the code in the scheduler for downloading a tiny file is hard coded to use the HTTP protocol, rather than HTTPS. This means that an attacker could perform a Man-in-the-Middle attack, changing th...
GO-2025-3970 DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error in d7y.io/dragonfly
DragonFly vulnerable to panics due to nil pointer dereference when using variables created alongside an error in d7y.io/dragonfly...
GO-2025-3969 DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly
DragonFly's manager generates mTLS certificates for arbitrary IP addresses in d7y.io/dragonfly...
GO-2025-3963 Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly
Dragonfly incorrectly handles a task structure’s usedTrac field in d7y.io/dragonfly...
GO-2025-3973 DragonFly has weak integrity checks for downloaded files in d7y.io/dragonfly
DragonFly has weak integrity checks for downloaded files in d7y.io/dragonfly...