CVE-2025-12764

Summary of CVE-2025-12764 (pgAdmin4) : The vulnerability affects pgAdmin4 versions up to 9.9 where an improper validation of characters in a username during LDAP authentication allows LDAP injections, which can cause the DC/LDAP server and client to process an excessive amount of data and trigger...

Siemens SIMATIC S7-1500 Always-Incorrect Control Flow Implementation (CVE-2024-56770)

net/sched: netem: The interface fully stops transferring packets and locks. In this case, the child qdisc and tfifo are empty, but 'qlen' indicates the tfifo is at its limit and no more packets are accepted. This plugin only works with Tenable.ot. Please visit...

LY Corporation: page.line.me Open Redirect Leading to OAuth Authorization Code Exposure and Access Token Compromise

An open redirect vulnerability was identified in page.line.me because redirect destinations were not properly restricted to trusted domains. This vulnerability could have been abused within an OAuth 2.0 authorization flow to cause the authorization response to be sent to an attacker-controlled...

CVE-2021-4464: Stack-based Buffer Overflow

FiberHome AN5506-04-FA firmware versions up to and including RP2631 and HG6245D prior to RP2602 contain a stack-based buffer overflow, as the HTTP service 'webs' fails to enforce maximum lengths for Cookie header values. When a cookie longer than 511 bytes is processed, a stack buffer is overrun,...

CVE-2025-64432

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to...

CVE-2025-35963

Insufficient control flow management for some IntelR PROSet/Wireless WiFi Software for Windows before version 23.160 within Ring 2: Device Drivers may allow a denial of service. Unprivileged software adversary with an unauthenticated user combined with a low complexity attack may enable denial of...

lemlist: Authentication Token Theft via Open Redirect in Callback URL Parameter

A vulnerability was identified in the email signup flow of a website that enabled authentication token theft through manipulation of the callback URL parameter. The vulnerability occurred when an attacker modified the callbackUrl parameter during the email signup process to point to an...

MAL-2025-114391 Malicious code in hadi-bakso96-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 18164aac7d616789411257197e1d9ec3336dddc3c306dbfb974a8c74464a005f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out ...

kernel: RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow

A flaw was found in the Linux kernel's mlx5 Remote Direct Memory Access RDMA driver. When handling completion queue entries, the driver incorrectly matches firmware queue pair numbers against internal driver structures, leading to the selection of an invalid queue pair. A local user could exploit...

kernel: sched: sch_cake: add bounds checks to host bulk flow fairness counts

In the Linux kernel, the following vulnerability has been resolved: sched: schcake: add bounds checks to host bulk flow fairness counts Even though we fixed a logic error in the commit cited below, syzbot still managed to trigger an underflow of the per-host bulk flow counters, leading to an out ...

Malicious code in ghjcng-devapptea (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a3cb8be84449e48675e06963d09248604561854f4278d6b76b0da499217f0000 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-103549 Malicious code in hanafi-moci94-ruro (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 997d7b98112050229465f4eb126eb354e2296329e89d18a4989f0a42c3948265 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in conceptual_snake_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 462a2897ec19553829060f3ca9490122e19f69dc36aae8c46809157ebc5549d3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-91889 Malicious code in vina-keraktelor57-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 301b92ad36399773a733d5ad8066c6bc3f77acb9583184368527cacaa91fbc93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bayu-semur18-breki (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7be6324072ade5c9d2031835fa39c433a39cfbca0e050860a32a09971206c299 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in specified-black-hookworm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 147a89f13c059a0f1f900ef4f18e322c2dd43ce1233b0b963be734f5980dd064 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in candra-takokak92-sukiwir (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a4b94aab6bd9c02998dac8e89926e7de48d9867e6e1cccbf0982e9a0325337c0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-55342

Quipux 4.0.1 through e1774ac allows enumeration of usernames, and accessing the Ecuadorean identification number for all registered users via the Administracion/usuarios/cambiarpasswordolvidovalidar.php txtlogin parameter...

BLADE: Behavior-Level Anomaly Detection Using Network Traffic in Web Services

With their widespread popularity, web services have become the main targets of various cyberattacks. Existing traffic anomaly detection approaches focus on flow-level attacks, yet fail to recognize behavior-level attacks, which appear benign in individual flows but reveal malicious purpose using...