Malicious Package

Overview time-check-server-get is a malicious package. This package contains malicious code intended to exfiltrate data, and its contents have been removed from the official package manager. Although it appears to be a time-related utility, its main function is to collect system information and...

PT-2026-55673

Name of the Vulnerable Software and Affected Versions picklescan versions prior to 0.0.29 Description The software fails to detect malicious pickle files that utilize the idlelib.calltip.get entity function within reduce methods. This allows attackers to embed undetected code in pickle files, whi...

Linux Distros Unpatched Vulnerability : CVE-2021-40609

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The GetHintFormat function in GPAC 1.0.1 allows attackers to cause a denial of service via a crafted file in the MP4Box command. CVE-2021-40609 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2020-35381

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - jsonparser 1.0.0 allows attackers to cause a denial of service panic: runtime error: slice bounds out of range via a GET call. CVE-2020-35381 Note that Nessus...

Linux Distros Unpatched Vulnerability : CVE-2021-39516

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in libjpeg through 2020021. A NULL pointer dereference exists in the function HuffmanDecoder::Get located in huffmandecoder.hpp. It allo...

PT-2025-34757 · Macvim · Macvim

Name of the Vulnerable Software and Affected Versions: MacVim affected versions not specified Description: MacVim’s configuration on macOS, specifically the presence of the “com.apple.security.get-task-allow” entitlement, allows local attackers with unprivileged access to attach a debugger, read ...

PT-2025-34758 · Unknown +1 · Invoice Ninja +1

Name of the Vulnerable Software and Affected Versions: Invoice Ninja versions prior to 5.0.175 Description: Invoice Ninja on macOS is susceptible to a local privilege escalation issue. The presence of the “com.apple.security.get-task-allow” entitlement allows local attackers with unprivileged...

Alibaba Cloud Linux 3 : 0141: go-toolset:an8 (ALINUX3-SA-2025:0141)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by a vulnerability as referenced in the ALINUX3-SA-2025:0141 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2025-4674: The go command may execute unexpecte...

Linux Distros Unpatched Vulnerability : CVE-2020-6104

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An exploitable information disclosure vulnerability exists in the getdnodeofdata functionality of F2fs- Tools F2fs.Fsck 1.13. A specially crafted f2fs filesyste...

CVE-2025-52130

File upload vulnerability in WebErpMesv2 1.17 in the app/Http/Controllers/FactoryController.php controller. This flaw allows an authenticated attacker to upload arbitrary files, including PHP scripts, which can be accessed via direct GET requests, potentially resulting in remote code execution RC...

CVE-2025-57772

CVE-2025-57772 affects DataEase prior to 2.10.12. A H2 JDBC RCE bypass exists where the getJdbcUrl method can return the JdbcUrl parameter, bypassing H2 filtering and allowing the JDBC URL to specify the driver (e.g., driver: org.h2.Driver) for the connection. This leads to potential remote code ...

CVE-2025-51281

D-Link DI-8100 16.07.26A1 is vulnerable to Buffer Overflow via the en, val and id parameters in the qjasp function. This vulnerability allows authenticated attackers to cause a Denial of Service DoS by sending crafted GET requests with overly long values for these parameters...

CVE-2025-29519

A command injection vulnerability in the EXE parameter of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to execute arbitrary commands via supplying a crafted GET request...

CVE-2025-29519

A command injection vulnerability in the EXE parameter of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to execute arbitrary commands via supplying a crafted GET request...

CVE-2024-46412

Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-location...

CVE-2024-46412

Incorrect access control in the prehandle function of Rebuild v3.7.7 allows attackers to bypass authentication via a crafted GET request sent to /commons/ip-location...

PT-2025-34661 · D Link · Di-8100

Name of the Vulnerable Software and Affected Versions: D-Link DI-8100 version 16.07.26A1 Description: The D-Link DI-8100 version 16.07.26A1 is susceptible to a buffer overflow issue. This occurs through the qj asp function when processing crafted GET requests containing excessively long values fo...

CVE-2025-29519

CVE-2025-29519 affects the D-Link DSL-7740C modem with firmware DSL7740C.V6.TR069.20211230. The vulnerability is a command injection in the EXE parameter that can be exploited by sending a crafted GET request, enabling an attacker to execute arbitrary commands on the device. The available connect...

PT-2025-44097

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A flaw exists in the Linux kernel where the return value of the platform get resource function is not properly checked. This function can return NULL in case of failure, and the lack of ...

CVE-2025-29519

A command injection vulnerability in the EXE parameter of D-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 allows attackers to execute arbitrary commands via supplying a crafted GET request...