19305 matches found
Embedded Malicious Code
Overview num2words is a malicious package. A malicious actor compromised the credentials of one of the package maintainers via a phishing attack; This allowed the attacker to modify the intialization script init.py and publish tampered versions of the package to PyPI. Script Behavior The code...
Exploit for CVE-2017-3143
Awesome Vulnerability Research 🦄 A curated list of the awesome resources about the Vulnerability Research First things first: There are no exploits in this project. Vulnerabilities != Exploits A Vulnerability resides in the software itself, doing nothing on its own. If you are really curious abou...
easy-linux-pwn
This is a set of Linux binary exploitation tasks for beginners on various architectures. The tasks are designed to be solved using a suggested approach, even if there are other easier ways. The tasks assume a dynamically linked libc with a known binary and require the use of ROP Return-Oriented...
[SECURITY] Fedora 42 Update: mingw-binutils-2.43.1-4.fc42
Cross compiled binutils utilities like 'strip', 'as', 'ld' which understand Windows executables and DLLs...
CVE-2025-6241
Lakeside Software's SysTrack endpoint monitoring software contains a vulnerability in the LsiAgent.exe component. The software improperly handles the dynamic-link library search order by attempting to load several DLL files (such as wfapi.dll ) that are not included in the default installation. I...
UBUNTU-CVE-2025-38398
In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: reallocate BAM transactions Using the mtdnandbiterrs module for testing the driver occasionally results in weird things like below. 1. swiotlb mapping fails with the following message: 85.926216 qcomsnand...
CVE-2025-38398
In the Linux kernel, the following vulnerability has been resolved: spi: spi-qpic-snand: reallocate BAM transactions Using the mtdnandbiterrs module for testing the driver occasionally results in weird things like below. 1. swiotlb mapping fails with the following message: 85.926216 qcomsnand...
Commvault for Windows security vulnerabilities
Commvault for Windows is a data backup, recovery software from Commvault, Inc. A security vulnerability exists in Commvault for Windows that originates from a DLL injection and could lead to arbitrary code execution. The following versions are affected: version 11.20.0, version 11.28.0, version...
Linux Kernel Security Vulnerabilities
Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that originates in the riscv architecture cpuopssbi module that uses dynamically allocated memory to invalidate a physical...
MB CONNECT LINE mbNET.mini Cross-Site Scripting Vulnerability
The mbNET.mini from MB CONNECT LINE is an industrial router designed for industrial scenarios and is primarily used to enable secure remote connections to machines and systems. A cross-site scripting vulnerability exists in MB CONNECT LINE mbNET.mini, which stems from improper neutralization of...
MediaTek Bluetooth Firmware Privilege Escalation
The vulnerability of the Bluetooth driver’s firmware microprogramming software for MediaTek is related to buffer overflow in dynamic memory. Exploiting this vulnerability can allow a remote attacker to gain increased privileges...
CVE-2025-41681
A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...
Remote File Inclusion
librenms/librenms is vulnerable to Remote File Inclusion RFI. The vulnerability is due to unsafe dynamic file inclusion caused by the ajaxform.php endpoint using user-controlled POST input in the type parameter to include .inc.php files without proper validation or allowlisting, potentially leadi...
Mobile Security Framework Dynamic_analysis.html XSS
The vulnerability of the dynamicanalysis.htm component in the Mobile Security Framework MobSF for mobile application security research is related to the lack of protective measures for the web page structure. Exploiting this vulnerability allows a remote attacker to execute cross-site scripting...
Trend Micro Apex One Data Loss Prevention Code Execution
The vulnerability of the Data Loss Prevention module in Trend Micro Apex One and Apex One as a Service antivirus software is related to an uncontrolled element in the search process. Exploiting this vulnerability could allow a malicious actor, operating remotely, to execute arbitrary code using a...
CVE-2025-7427
Uncontrolled Search Path Element in Arm Development Studio before 2025 may allow an attacker to perform a DLL hijacking attack. Successful exploitation could lead to local arbitrary code execution in the context of the user running Arm Development Studio...
Arm Development Studio code-related vulnerabilities
Arm Development Studio is a software development tool designed for the Arm architecture from Arm UK. A code issue vulnerability exists in versions prior to Arm Development Studio 2025 that stems from an uncontrolled search path element that could lead to a DLL hijacking attack...
CVE-2025-41681
A high privileged remote attacker can gain persistent XSS via POST requests due to improper neutralization of special elements used to create dynamic content...