webkitgtk: Processing maliciously crafted web content may lead to memory corruption

A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to an improper validation of the index to access an array, resulting in memory corruption...

webkitgtk: Processing maliciously crafted web content may lead to memory corruption

A flaw was found in WebKitGTK. Processing malicious web content can cause a buffer overflow due to an improper validation of the index to access an array, resulting in memory corruption...

CVE-2025-5013

A vulnerability, which was classified as problematic, was found in HkCms up to 2.3.2.240702. This affects an unknown part of the file /index.php/search/index.html of the component Search. The manipulation of the argument keyword leads to cross site scripting. It is possible to initiate the attack...

CVE-2025-5011

A vulnerability classified as problematic was found in moonlightL hexo-boot 4.3.0. This vulnerability affects unknown code of the file /admin/home/index.html of the component Dynamic List Page. The manipulation leads to cross site scripting. The attack can be initiated remotely. The exploit has...

HkCms 安全漏洞

HkCms is a free and open source content management system from HkCms Open Source. A security vulnerability exists in HkCms 2.3.2.240702 and earlier versions, which stems from improper manipulation of the keyword parameter in the file /index.php/search/index.html, which may lead to cross-site...

firefox: thunderbird: Out-of-bounds access when optimizing linear sums

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: An attacker could perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes...

Malicious code in octopus32 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 15fe4c8243ee2e3d9bb59df9134466819fdcb2e151cc4d79568dc4eb2dea9ac9 The obfuscated code downloads and starts a remote executable. The remote file has limited detection in VT, but contains at least code to add Defender exclusion...

MAL-2025-5122 Malicious code in octopus32 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 15fe4c8243ee2e3d9bb59df9134466819fdcb2e151cc4d79568dc4eb2dea9ac9 The obfuscated code downloads and starts a remote executable. The remote file has limited detection in VT, but contains at least code to add Defender exclusion...

SUSE CVE-2025-4919

An attacker was able to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. This vulnerability was fixed in Firefox 138.0.4, Firefox ESR 128.10.1, Firefox ESR 115.23.1, Thunderbird 128.10.2, and Thunderbird 138.0.2...

Hexo 安全漏洞

Hexo is a fast, simple and powerful blogging framework by Tommy Chen, a personal developer in China. A security vulnerability exists in Hexo version 4.3.0, which stems from improper handling of the file /admin/home/index.html, which could lead to a cross-site scripting attack...

DDoSecrets Adds 410GB of TeleMessage Breach Data to Index

DDoSecrets indexes 410GB of breached TeleMessage data, including messages and metadata, from hack tied to unsecured Signal clone used by US government officials...

CVE-2025-4941

A vulnerability, which was classified as critical, was found in PHPGurukul Credit Card Application Management System 1.0. Affected is an unknown function of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. It is possible to launch the attack remotely. T...

GHSA-5RJG-FVGR-3XXF setuptools has a path traversal vulnerability in PackageIndex.download that leads to Arbitrary File Write

Summary A path traversal vulnerability in PackageIndex was fixed in setuptools version 78.1.1 Details def downloadurlself, url, tmpdir: Determine download filename name, fragment = egginfoforurlurl if name: while '..' in name: name = name.replace'..', '.'.replace'\', '' else: name = "downloaded"...

Malicious code in ai-labs-snippets-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2d5d4e1e66d1a84969c7af5822efb6e894abc0d263c87f583bf45591d216b85a During the importing, it loads a file pretending to an AI model. This file contains pickle-serialized code that exfiltrates data basic IP/username info, as wel...

CVE-2025-4913

A vulnerability was found in PHPGurukul Auto Taxi Stand Management System 1.0 and classified as critical. Affected by this issue is some unknown functionality of the file /admin/index.php. The manipulation of the argument Username leads to sql injection. The attack may be launched remotely. The...

PHPGurukul Auto Taxi Stand Management System 安全漏洞

Auto Taxi Stand Management System is an auto cab stand management system. Auto Taxi Stand Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally-entered SQL statement in the parameter Username in the file /admin/index.php. An...

PHPGurukul Credit Card Application Management System 注入漏洞

Credit Card Application Management System is a credit card application management system. Credit Card Application Management System suffers from a SQL injection vulnerability that originates from the lack of validation of an externally entered SQL statement in the parameter Username in the file...

QUT-DV25: a Dataset for Dynamic Analysis of Next-Gen Software Supply Chain Attacks

Securing software supply chains is a growing challenge due to the inadequacy of existing datasets in capturing the complexity of next-gen attacks, such as multiphase malware execution, remote access activation, and dynamic payload generation. Existing datasets, which rely on metadata inspection a...

Malicious code in coloramapkgs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c7f00bfa67a0d8743c0d46766e677dce5d28db461505c662fcb8cd9efc4b2417 Importing the module starts download and running a remote executable, identified as malware by AVs --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2025-5126 Malicious code in readmecolorama (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4f74e374afe61cdaa52e0c651ae413abc94b50cd15de263a9d247de21bfc6fa1 Importing the module starts download and running a remote executable, identified as malware by AVs --- Category: MALICIOUS - The campaign has clearly malicious...