CVE-2020-10532

The AD Helper component in WatchGuard Fireware before 5.8.5.10317 allows remote attackers to discover cleartext passwords via the /domains/list URI...

CVE-2018-20975

Fat Free CRM before 0.18.1 has XSS in the tagshelper in app/helpers/tagshelper.rb...

CVE-2019-13014

Little Snitch versions 4.4.0 fixes a vulnerability in a privileged helper tool. However, the operating system may have made a copy of the privileged helper which is not removed or updated immediately. Computers may therefore still be vulnerable after upgrading to 4.4.0. Version 4.4.1 fixes this...

CVE-2019-12174

hide.me before 2.4.4 on macOS suffers from a privilege escalation vulnerability in the connectWithExecutablePath:configFilePath:configFileName method of the mehidevpnhelper.Helper class in the me.hide.vpnhelper macOS privilege helper tool. This method takes user-supplied input and can be used to...

CVE-2018-8739

VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root...

CVE-2003-0670

Sustworks IPNetSentryX and IPNetMonitorX allow local users to sniff network packets via the setuid helper applications 1 RunTCPDump, which calls tcpdump, and 2 RunTCPFlow, which calls tcpflow...

Malicious code in node-crypto-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cad7476ddf9290a5b4fa0e038b37e2133e0f5e5495e71bc825b1baf99d4e82f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in node-crypto-helper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-4108 Malicious code in node-crypto-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cad7476ddf9290a5b4fa0e038b37e2133e0f5e5495e71bc825b1baf99d4e82f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-37965

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix invalid context error in dml helper Why "BUG: sleeping function called from invalid context" error. after: "drm/amd/display: Protect FPU in dml2validate/dml21validate" The populatedmlplanecfgfromplanestate us...

CVE-2025-37965 drm/amd/display: Fix invalid context error in dml helper

In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Fix invalid context error in dml helper Why "BUG: sleeping function called from invalid context" error. after: "drm/amd/display: Protect FPU in dml2validate/dml21validate" The populatedmlplanecfgfromplanestate us...

DEBIAN-CVE-2025-37955

In the Linux kernel, the following vulnerability has been resolved: virtio-net: free xskbuffs on error in virtnetxskpoolenable The selftests added to our CI by Bui Quang Minh recently reveals that there is a mem leak on the error path of virtnetxskpoolenable: unreferenced object 0xffff88800a68a00...

Path Traversal

getkirby/cms is vulnerable to path traversal. The vulnerability is due to a missing path traversal check on dynamic collection names used in the collection helper or $kirby-collection method, allows attackers to manipulate the collection path to access and execute files outside the intended...

Malware in rsk-transaction-helper

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

CVE-2025-48050: Path Traversal: '../filedir'

In DOMPurify through 3.2.5 before 6bc6d60, scripts/server.js does not ensure that a pathname is located under the current working directory. NOTE: the Supplier disputes the significance of this report because the "Uncontrolled data used in path expression" occurs "in a development helper script...

Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

TL;DR This vulnerability affects all Kirby sites that use the snippet helper or $kirby-snippet method with a dynamic snippet name such as a snippet name that depends on request or user data. Sites that only use fixed calls to the snippet helper/$kirby-snippet method i.e. calls with a simple strin...

GHSA-FW82-87P8-V6HP Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

TL;DR This vulnerability affects all Kirby sites that use the snippet helper or $kirby-snippet method with a dynamic snippet name such as a snippet name that depends on request or user data. Sites that only use fixed calls to the snippet helper/$kirby-snippet method i.e. calls with a simple strin...

CVE-2025-31493 Path traversal of collection names during file system lookup

Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the collection helper or $kirby-collection method with a dynamic collection name such as a collection name that depends on request or user data...

CVE-2025-30159 Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the snippet helper or $kirby-snippet method with a dynamic snippet name such as a snippet name that depends on request or user data. Sites that onl...

CVE-2025-30159 Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the snippet helper or $kirby-snippet method with a dynamic snippet name such as a snippet name that depends on request or user data. Sites that onl...