PT-2025-35721

Name of the Vulnerable Software and Affected Versions: CRESTRON TOUCHSCREENS x70 versions 3.001.0031.001 through 3.001.0034.001 Description: An improper neutralization of argument delimiters in a command 'Argument Injection' vulnerability exists in CRESTRON TOUCHSCREENS x70. A specially crafted S...

Linux Distros Unpatched Vulnerability : CVE-2025-1550

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By...

Forecasting Future DDoS Attacks Using Long Short Term Memory (LSTM) Model

This paper forecasts future Distributed Denial of Service DDoS attacks using deep learning models. Although several studies address forecasting DDoS attacks, they remain relatively limited compared to detection-focused research. By studying the current trends and forecasting based on newer and...

Linux Distros Unpatched Vulnerability : CVE-2024-36137

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability has been identified in Node.js, affecting users of the experimental permission model when the --allow-fs-write flag is used. Node.js Permission...

CVE-2025-9769 D-Link DI-7400G+ mng_platform.asp sub_478D28 command injection

A security flaw has been discovered in D-Link DI-7400G+ 19.12.25A1. Affected is the function sub478D28 of the file /mngplatform.asp. The manipulation of the argument addr with the input echo 12345 poc.txt results in command injection. An attack on the physical device is feasible. The exploit has...

Arbitrary Code Execution

Keras is vulnerable to Arbitrary Code Execution. The vulnerability is due to improper validation in the Model.loadmodel method when loading specially crafted .keras model archives...

PT-2025-35469

Name of the Vulnerable Software and Affected Versions: D-Link DI-7400G+ version 19.12.25A1 Description: A security flaw exists in the D-Link DI-7400G+ router. The issue is located in the sub 478D28 function of the /mng platform.asp file. Manipulation of the addr argument with the input echo 12345...

The vulnerability of the ReadFileUtf8() function in the Node.js software licensing model allows a hacker to trigger a service failure.

The vulnerability of the ReadFileUtf8 function in the Node.js software licensing model is related to the lack of memory release after its effective lifespan. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

The vulnerability of the Node.js software platform’s permission model, related to deficiencies in HTTP request processing, allows attackers to circumvent existing security restrictions and send unauthorized requests.

The vulnerability of the Node.js software platform’s permission model is related to deficiencies in HTTP request processing. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and send unauthorized requests...

The vulnerability of the ThrowException() function in the Node.js software licensing model allows a violator to trigger a service failure.

The vulnerability of the ThrowException function in the Node.js software licensing model is related to an error in handling exceptional states during the processing of the SignTraits::DeriveBits method. Exploiting this vulnerability could allow a malicious actor to trigger a service failure...

CVE-2025-9737

A vulnerability was detected in O2OA up to 10.0-410. Affected is an unknown function of the file /xqueryassembledesigner/jaxrs/importmodel of the component Personal Profile Page. Performing manipulation of the argument description/applicationName/queryName results in cross site scripting. Remote...

CVE-2025-9737

CVE-2025-9737 affects O2OA before or up to version 10.0-410, in the Personal Profile Page’s file /x_query_assemble_designer/jaxrs/importmodel. The vulnerability is a cross-site scripting flaw caused by manipulating the arguments description/applicationName/queryName, allowing remote exploitation....

CVE-2025-9737 O2OA Personal Profile importmodel cross site scripting

A vulnerability was detected in O2OA up to 10.0-410. Affected is an unknown function of the file /xqueryassembledesigner/jaxrs/importmodel of the component Personal Profile Page. Performing manipulation of the argument description/applicationName/queryName results in cross site scripting. Remote...

CVE-2025-9579

A weakness has been identified in LB-LINK BL-X26 1.2.8. The impacted element is an unknown function of the file /goform/sethidessidcfg of the component HTTP Handler. This manipulation of the argument enable causes os command injection. The attack can be initiated remotely. The exploit has been ma...

VULSOVER: Vulnerability Detection Via LLM-Driven Constraint Solving

Traditional vulnerability detection methods rely heavily on predefined rule matching, which often fails to capture vulnerabilities accurately. With the rise of large language models LLMs, leveraging their ability to understand code semantics has emerged as a promising direction for achieving more...

CVE-2025-29525

DASAN GPON ONU H660WM OS version H660WMR210825 Hardware version DS-E5-583-A1 was discovered to contain insecure default credentials in the modem's control panel...

Linux Distros Unpatched Vulnerability : CVE-2025-8747

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A safe mode bypass vulnerability in the Model.loadmodel method in Keras versions 3.0.0 through 3.10.0 allows an attacker to achieve arbitrary code execution by...

Integer Overflow

executorch is vulnerable to integer overflow. The vulnerability is due to improper handling in model loading that causes smaller-than-expected memory allocation, which allows an attacker to achieve code execution or other malicious effects...

CVE-2025-9603

A vulnerability was determined in Telesquare TLR-2005KSH 1.2.4. The affected element is an unknown function of the file /cgi-bin/internet.cgi?Command=lanCfg. Executing manipulation of the argument Hostname can lead to command injection. The attack may be performed from a remote location. The...

MCP SSH Agent 安全漏洞

MCP SSH Agent is an open source Model Context Protocol server for managing and controlling SSH connections from Aionda GmbH. A security vulnerability exists in MCP SSH Agent version 1.0.3 and earlier, which stems from a command injection in the file server-simple.mjs...