MAL-2025-165721 Malicious code in samehada-zs-r7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c6edcffcf35209448ee5842eda57a5edb839d0bc6b0be49846517681154c9d6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165710 Malicious code in samehada-fzhs-r7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9093451aabb3195bc16518c3f0db592c64d580f87f570e09938cc3f768d0a937 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165720 Malicious code in samehada-zhs-r7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b6f35766685a5ca7145c9ea021d85c101b9cbcc392211528380bf45a68bb399 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-165706 Malicious code in samehada-aazs-r7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f68927e2f0e9d7f209bacec1135dae53e5551c2a681e46e246c5a02eaf48b56a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

CVE-2025-10777 JSC R7 R7-Office Document Server downloadas path traversal

A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of the argument cmd can lead to path traversal. The attack can be launched remotely. Upgrading to version 2025.3.1.923 is recommended to addre...

CVE-2025-10777 JSC R7 R7-Office Document Server downloadas path traversal

A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of the argument cmd can lead to path traversal. The attack can be launched remotely. Upgrading to version 2025.3.1.923 is recommended to addre...

CVE-2025-10777

CVE-2025-10777 affects the JSC R7 R7-Office Document Server (versions up to 20250820). A flaw in an unknown function of the file /downloadas/ allows remote exploitation by manipulating the cmd argument to trigger a path traversal. The vendor confirms this vulnerability and specifies a fix in rele...

CVE-2025-10777: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in JSC R7 R7-Office Document Server up to 20250820. Impacted is an unknown function of the file /downloadas/. Executing manipulation of the argument cmd can lead to path traversal. The attack can be launched remotely. Upgrading to version 2025.3.1.923 is recommended to addre...

Malicious code in @zalastax/nolb-_types_r7 (npm)

The package @zalastax/nolb-typesr7 was found to contain malicious code...

MAL-2025-10534 Malicious code in @zalastax/nolb-_types_r7 (npm)

The package @zalastax/nolb-typesr7 was found to contain malicious code...

PT-2026-7966

Name of the Vulnerable Software and Affected Versions Vnet/IP Interface Package versions R1.07.00 and earlier Description A flaw exists in the Vnet/IP Interface Package that could cause the Vnet/IP software stack process to terminate when receiving specially crafted network packets. Recommendatio...

PT-2026-7967

Name of the Vulnerable Software and Affected Versions Vnet/IP Interface Package versions R1.07.00 and earlier Description A flaw exists in the Vnet/IP Interface Package that could cause the Vnet/IP software stack process to terminate if the product receives specially crafted network packets...

Microsoft Windows TOCTOU Local Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Windows Kernel Time of Check Time of Use LPE in AuthzBasepCopyoutInternalSecurityAttributes', 'Description' = %q CVE-2024-30088 is a Windows Kern...

The vulnerability of the R7-Office corporate server, related to the lack of measures taken to protect the website structure, allows attackers to carry out XSS attacks.

The vulnerability of the R7-Office corporate server is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to carry out XSS attacks remotely...

CVE-2023-34127

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics:...

CVE-2023-34128

Tomcat application credentials are hardcoded in SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions...

Command injection

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics:...

CVE-2023-34126

Vulnerability in SonicWall GMS and Analytics allows an authenticated attacker to upload files on the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions...

CVE-2023-34125

Path Traversal vulnerability in GMS and Analytics allows an authenticated attacker to read arbitrary files from the underlying filesystem with root privileges. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions...

PT-2023-3806 · Sonicwall · Sonicwall Gms +1

Name of the Vulnerable Software and Affected Versions: SonicWall GMS versions 9.3.2-SP1 and earlier SonicWall Analytics versions 2.5.0.4-R7 and earlier Description: The issue is related to the exposure of sensitive information to unauthorized actors in SonicWall GMS and Analytics, allowing an...