16023 matches found
CVE-2025-55796
The openml/openml.org web application version v2.0.20241110 uses predictable MD5-based tokens for critical user workflows such as signup confirmation, password resets, email confirmation resends, and email change confirmation. These tokens are generated by hashing the current timestamp formatted ...
CVE-2025-55796
The openml/openml.org web application (version v2.0.20241110 ) is vulnerable to account takeover due to the use of predictable MD5-based tokens for critical workflows, including signup confirmation, password resets, and email changes. The root cause is that these tokens are generated by hashing a...
OpenML Frontend security vulnerabilities
OpenML Frontend is an OpenML Frontend page from OpenML Open Source. A security vulnerability exists in OpenML Frontend version v2.0.20241110, which stems from the use of predictable MD5-based tokens that could lead to account takeover...
Mozilla Thunderbird < 45.7
The version of Thunderbird installed on the remote macOS or Mac OS X host is prior to 45.7. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2017-03 advisory. - A use-after-free vulnerability in the Media Decoder when working with media files when some events are...
Linux netfilter Heap Buffer Overflow DoS
The vulnerability of the nfconntrackhashcheckinsert function in the net/netfilter/nfconntrackcore.c module of the netfilter component of the Linux operating system is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability could allow a attacker to...
AVEVA Edge encryption issue vulnerabilities
AVEVA Edge is a highly scalable and flexible HMI/SCADA software from UK-based Jianwei Software AVEVA. AVEVA Edge suffers from an encryption issue vulnerability that stems from an attacker being able to reverse engineer an Edge user's application native password or Active Directory password by...
HSEC-2023-0001 Hash flooding vulnerability in aeson
Hash flooding vulnerability in aeson aeson was vulnerable to hash flooding a.k.a. hash DoS. The issue is a consequence of the HashMap implementation from unordered-containers. It results in a denial of service through CPU consumption. This technique has been used in real-world attacks against a...
HSEC-2023-0011 git-annex GPG decryption attack via compromised remote
git-annex GPG decryption attack via compromised remote A malicious server for a special remote could trick git-annex into decrypting a file that was encrypted to the user's GPG key. This attack could be used to expose encrypted data that was never stored in git-annex. Daniel Dent discovered this...
Rockwell Automation Studio 5000 Simulation Interface Server-Side Request Forgery Vulnerability
Rockwell Automation Studio 5000 Simulation Interface is a simulation modeling tool from Rockwell Automation. The Rockwell Automation Studio 5000 Simulation Interface suffers from a server-side request forgery vulnerability that stems from the server not implementing sufficient authentication...
GHSA-8JPW-GPR4-8CMH Directus's conceal fields are searchable if read permissions enabled
Summary A vulnerability allows authenticated users to search concealed/sensitive fields when they have read permissions. While actual values remain masked , successful matches can be detected through returned records, enabling enumeration attacks on sensitive data. Details The system permits sear...
Improper Authorization
Overview github.com/filebrowser/filebrowser/v2/http is a web file browser. Affected versions of this package are vulnerable to Improper Authorization via the shareDeleteHandler function, which handles deletion requests based solely on the share hash, and does not verify whether the link.UserID...
CVE-2024-45301
Mintty is a terminal emulator for Cygwin, MSYS, and WSL. In versions 2.3.6 through 3.7.4, several escape sequences can cause the mintty process to access a file in a specific path. It is triggered by simply printing them out on bash. An attacker can specify an arbitrary network path, negotiate an...
Malicious code in eta-sed-assert-spy-hash (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aba02fba2294b944dedb22735bc1a124430a994c135af1e2b1361494f868a743 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in abstract-hash-key-report-load (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af67a09c9ac8b1f5a97cb010cec5f8683ef9b54771520fa4630f0ba372d1ba86 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in daemon-epsilon-hash-link-slow (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1247ea1f9679d0a4af4536122840c9b4be02d663783f7a7a4e4a006907deb9b3 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in hash-char-new-alert-sandbox (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 157e9621c61fae908d1e7be8b87a7307a60fae9033b01116533f0b50fe64262d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-185448 Malicious code in analyze-abstract-hash-code-iota (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94747fbea6244359c0e5f32c8af9461dfd765fc51d10bca1d94dd3e3f0cef6b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-186630 Malicious code in double-benchmark-pipe-hash-virtualize (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3693bc7ca615b1cd5a5525161fc2c67df2038089b984d721e39eaf4b39dc51b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
MAL-2025-187281 Malicious code in hash-authorize-sanitize-signal-cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6036f529790af1d972ea5481f35974ed1ddef51980d2dfd257f1206670838669 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
