TencentOS Server 2: pki-core (TSSA-2022:0289)

The version of Tencent Linux installed on the remote TencentOS Server 2 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2022:0289 advisory. Package updates are available for TencentOS Server 2 that fix the following vulnerabilities:...

Malicious code in browser-history-analytics (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e1ac674eaa856956dea531487502bd21a51f5324bdfcaf788645bbbb41eb27f5 When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...

MAL-2025-191695 Malicious code in browser-history-analytics (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 e1ac674eaa856956dea531487502bd21a51f5324bdfcaf788645bbbb41eb27f5 When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...

Malicious code in browser-history-analysis (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 032a326beadf36ce66d29555a7dacc90d6dfc733435dc61852cbc1e5128ee73d When starting the server with expected functionality with potentially sensitive content, the package silently sends the location external IP to a remote...

CVE-2025-36506

External control of file name or path issue exists in RICOH Streamline NX V3 PC Client versions 3.5.0 to 3.242.0. If an attacker sends a specially crafted request, arbitrary files in the file system can be overwritten with log data...

The vulnerability of the gt-xsd-core and gt-wfs-ng libraries of GeoTools allows attackers to perform XXE attacks.

The vulnerability of the gt-xsd-core and gt-wfs-ng libraries of GeoTools is related to incorrect restrictions on XML links to external objects. Exploiting this vulnerability could allow a malicious actor to perform XXE attacks remotely...

GHSA-MVP5-QX9C-C3FV

creationtimestamp| type| source ---|---|--- 2025-06-13 17:38:04+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/18322 2025-06-13 18:01:53+00:00| published-proof-of-concept| Telegram/BdAJvjHyhFMVsKfZl02ptmuMNqjhviASPolesySVDo2DxO4...

Malicious code in mdp-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9dbfb2d3ae272dd0bda3bab2d03d7f1461dc50e5b834fd48ab7510f7e55b2a5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security update for libxml2

This update for libxml2 fixes the following issues: CVE-2024-40896: Fixed XXE vulnerability bsc1234812 Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the command listed for your...

The vulnerability of the software client service for Cisco WebEx Meetings allows a perpetrator to compromise the integrity of the protected information.

The vulnerability of Cisco Webex Meetings software client services relates to the loading of unreliable external data alongside reliable data. Exploiting this vulnerability allows a malicious actor to compromise the integrity of protected information...

RICOH Streamline NX V3 PC Client 安全漏洞

RICOH Streamline NX V3 PC Client is a complete solution for large-scale, integrated management of devices from Ricoh RICOH Japan. A security vulnerability exists in RICOH Streamline NX V3 PC Client versions 3.5.0 through 3.242.0, which originates from a file name or path external control, and cou...

Malicious code in @jito-lab/provider (npm)

The package communicates with a domain associated with malicious activity...

CVE-2024-34711

GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities XEE attack, then send GET request to any HTTP server. By default, GeoServer use...

CVE-2025-49190

The application is vulnerable to Server-Side Request Forgery SSRF. An endpoint can be used to send server internal requests to other ports...

CVE-2025-44044

Keyoti SearchUnit prior to 9.0.0. is vulnerable to XML External Entity XXE. An attacker who can force a vulnerable SearchUnit host into parsing maliciously crafted XML and/or DTD files can exfiltrate some files from the underlying operating system...

VMware AVI Load Balancer 安全漏洞

VMware Avi Load Balancer is a load balancing platform from VMware. VMware Avi Load Balancer suffers from a SQL injection vulnerability that stems from the application's lack of validation of externally entered SQL statements. An attacker can exploit this vulnerability to execute illegal SQL...

CVE-2025-31039

Improper Restriction of XML External Entity Reference vulnerability in pixelgrade Category Icon category-icon allows XML Entity Linking.This issue affects Category Icon: from n/a through = 1.0.3...

CVE-2025-5877

A vulnerability, which was classified as problematic, has been found in Fengoffice Feng Office 3.2.2.1. Affected by this issue is some unknown functionality of the file /application/models/ApplicationDataObject.class.php of the component Document Upload Handler. The manipulation leads to xml...

CVE-2025-5986

A crafted HTML email using mailbox:/// links can trigger automatic, unsolicited downloads of .pdf files to the user's desktop or home directory without prompting, even if auto-saving is disabled. This behavior can be abused to fill the disk with garbage data e.g. using /dev/urandom on Linux or to...

Files or Directories Accessible to External Parties

Overview github.com/minio/minio/cmd is an open source object storage server compatible with Amazon S3 APIs. Affected versions of this package are vulnerable to Files or Directories Accessible to External Parties via the function ListMultipartUploads in the file erasure-server-pool.go. An attacker...