EUVD-2025-12862

Malicious code in bioql PyPI...

EUVD-2025-7450

Malicious code in bioql PyPI...

EUVD-2023-1460

Malicious code in bioql PyPI...

EUVD-2023-33742

Malicious code in bioql PyPI...

EUVD-2024-53294

Malicious code in bioql PyPI...

GHSA-472F-VMF2-PR3H Canonical LXD Path Traversal Vulnerability in Instance Log File Retrieval Function

Impact Although outside the scope of this penetration test, a path traversal vulnerability exists in the validLogFileName function that validates log file names in lxd/instancelogs.go in the LXD 5.0 LTS series. This vulnerability was fixed in PR 15022 in February 2025, and is fixed in at least LX...

CVE-2025-59682

An issue was discovered in Django 4.2 before 4.2.25, 5.1 before 5.1.13, and 5.2 before 5.2.7. The django.utils.archive.extract function, used by the "startapp --template" and "startproject --template" commands, allows partial directory traversal via an archive with file paths sharing a common...

CVE-2025-57434

Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows...

PT-2025-47924

Name of the Vulnerable Software and Affected Versions Fluent Bit in http, in splunk, and in elasticsearch input plugins affected versions not specified Description The input plugins in http, in splunk, and in elasticsearch within Fluent Bit have a flaw in how they validate the tag key. The...

CVE-2025-57434

Creacast Creabox Manager contains a critical authentication flaw that allows an attacker to bypass login validation. The system grants access when the username is creabox and the password begins with the string creacast, regardless of what follows...

CVE-2025-57434

The Creacast Creabox Manager device management system contains a critical authentication flaw that allows for a login validation bypass. An attacker can gain unauthorized access by using the username creabox and a password starting with the prefix creacast, regardless of any subsequent characters...

OpenBao Secret Encryption Management System Code Execution

The vulnerability of the OpenBao encryption and secret management system lies in improper handling of code generation, particularly by manipulating the prefixes of logs. Exploiting this vulnerability allows a remote attacker to generate arbitrary codes...

GHSA-P5JQ-5383-QVC7 TYPO3 CMS uses insufficient entropy when generating passwords

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly...

CVE-2025-59015

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly...

CVE-2025-59015 Insufficient Entropy in Password Generation

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly...

CVE-2025-59015 Insufficient Entropy in Password Generation

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly...

CVE-2025-59015

TYPO3 CMS password generation vulnerability (CVE-2025-59015) affects TYPO3 CMS 12.0.0–12.4.36 and 13.0.0–13.4.17. A deterministic three-character prefix in the Password Generation component reduces entropy, enabling faster brute-force attacks. Impact is insufficient entropy in password generation...

TYPO3 12.0.0 < 12.4.37 / 13.0.0 < 13.4.18 (TYPO3-CORE-SA-2025-019)

The version of TYPO3 installed on the remote host is 12.0.0 prior to 12.4.37 / 13.0.0 prior to 13.4.18. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2025-019 advisory. - By default, the Password Generation component creates a password that always begins with a...

CVE-2025-59015: Insufficient Entropy

A deterministic three‑character prefix in the Password Generation component of TYPO3 CMS versions 12.0.0–12.4.36 and 13.0.0–13.4.17 reduces entropy, allowing attackers to carry out brute‑force attacks more quickly...

CVE-2025-58751

CVE-2025-58751 involves a path traversal issue in Vite Dev Server. The vulnerability affects apps that explicitly expose the Vite dev server to the network (using --host or server.host) and have the public directory feature enabled (default) with a symlink inside the public directory. In versions...