io.undertow:undertow-servlet (1.0.0.cr5), io.undertow:undertow-websockets-jsr (1.0.0.cr5) +2 more potentially affected by CVE-2025-9784 via io.undertow:undertow-core (1.0.0.cr5)

io.undertow:undertow-core MAVEN version 1.0.0.cr5 is affected by a known vulnerability. The following packages have a transitive dependency on io.undertow:undertow-core and may be impacted: - io.undertow:undertow-servlet 1.0.0.cr5 - io.undertow:undertow-websockets-jsr 1.0.0.cr5 -...

CVE-2025-51966

A cross-site scripting XSS vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially crafted PDF file, embedded JavaScript code executes within the application's privileged context, potentially allowing attackers to steal sensitive data or perfor...

PT-2025-51837

Name of the Vulnerable Software and Affected Versions Qualcomm embedded platform firmware affected versions not specified Description A memory corruption issue exists when loading invalid firmware during the boot process. This flaw is related to authorization mechanism deficiencies within the...

[SECURITY] Fedora 42 Update: cef-139.0.26^chromium139.0.7258.127-1.fc42

CEF is an embeddable build of Chromium, powered by WebKit Blink...

CVE-2025-48361

Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Retrieve Embedded Sensitive Data.This issue affects Hesabfa Accounting: from n/a through = 2.2.5...

CVE-2025-41702

The JWT secret key is embedded in the egOS WebGUI backend and is readable to the default user. An unauthenticated remote attacker can generate valid HS256 tokens and bypass authentication/authorization due to the use of hard-coded cryptographic key...

Linux Distros Unpatched Vulnerability : CVE-2020-17353

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - scm/define-stencil-commands.scm in LilyPond through 2.20.0, and 2.21.x through 2.21.4, when -dsafe is used, lacks restrictions on embedded-ps and embedded-svg, ...

CVE-2025-8857 Changing｜Clinic Image System - Use of Hard-coded Credentials

Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator credentials embedded in the source code...

CVE-2025-8857 Changing｜Clinic Image System - Use of Hard-coded Credentials

Clinic Image System developed by Changing contains hard-coded Credentials, allowing unauthenticated remote attackers to log into the system using administrator credentials embedded in the source code...

Hybrid Cryptographic Monitoring System for Side-Channel Attack Detection on PYNQ SoCs

AES-128 encryption is theoretically secure but vulnerable in practical deployments due to timing and fault injection attacks on embedded systems. This work presents a lightweight dual-detection framework combining statistical thresholding and machine learning ML for real-time anomaly detection. B...

Evope 1.1.3.20 Hardcoded Cryptographic Key

The component Evope Core in Evope version 1.1.3.20 uses a hardcoded cryptographic key, which means that encryption/decryption keys are permanently embedded in the source code, rather than being securely managed. This creates a critical security flaw because anyone who gains access to or...

PT-2025-35178

Name of the Vulnerable Software and Affected Versions: Clinic Image System affected versions not specified Description: The Clinic Image System developed by Changing contains hard-coded credentials. This allows unauthenticated remote attackers to log into the system using administrator credential...

iND Multiple Products: Operating System Command Injection Vulnerability

The iND HL330-DLS and iND LM-100 are both embedded hardware terminals from Japan-based iND Corporation. Operating system command injection vulnerability exists in several iND products. The vulnerability stems from OS command injection, which may result in executing arbitrary commands or obtaining...

iND’s various products have security vulnerabilities

The iND HL330-DLS and others are an embedded hardware terminal from iND Japan. A security vulnerability exists in several iND products. The vulnerability stems from the insecure storage of sensitive information, which may lead to the disclosure of configuration information. The following products...

CVE-2025-48361

Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Retrieve Embedded Sensitive Data.This issue affects Hesabfa Accounting: from n/a through = 2.2.5...

CVE-2025-48361

CVE-2025-48361 concerns a WordPress Hesabfa Accounting plugin vulnerability: insertion of sensitive information into sent data leading to potential retrieval of embedded sensitive data. Publicly documented impact is Exposure of sensitive information via log data for Hesabfa Accounting versions up...

PT-2025-35029

Name of the Vulnerable Software and Affected Versions: Hesabfa Accounting versions through 2.2.4 Description: Hesabfa Accounting is susceptible to a flaw that allows the retrieval of embedded sensitive data due to the insertion of sensitive information into sent data. Recommendations: Update...

CVE-2025-48361: Insertion of Sensitive Information Into Sent Data

Insertion of Sensitive Information Into Sent Data vulnerability in Saeed Sattar Beglou Hesabfa Accounting hesabfa-accounting allows Retrieve Embedded Sensitive Data.This issue affects Hesabfa Accounting: from n/a through = 2.2.5...

Embeded Malicious Code

Overview nx is a The core Nx plugin contains the core functionality of Nx like the project graph, nx commands and task orchestration. Affected versions of this package are vulnerable to Embeded Malicious Code through a malicious postinstall script that triggers a file named telemetry.js. A...

CVE-2025-52353

An arbitrary code execution vulnerability in Badaso CMS 2.9.11. The Media Manager allows authenticated users to upload files containing embedded PHP code via the file-upload endpoint, bypassing content-type validation. When such a file is accessed via its URL, the server executes the PHP payload,...