5883 matches found
EUVD-2021-6699
Malicious code in bioql PyPI...
EUVD-2023-54820
Malicious code in bioql PyPI...
EUVD-2022-0150
Malicious code in bioql PyPI...
EUVD-2023-34221
Malicious code in bioql PyPI...
PT-2025-40517
Name of the Vulnerable Software and Affected Versions Logo Software Inc. TigerWings ERP versions 01.01.00 through 3.02.99 Description The software contains a Use of Hard-coded Credentials issue, allowing for the reading of sensitive constants within the executable. Recommendations Update to versi...
Logo TigerWings ERP 安全漏洞
Logo TigerWings ERP is an enterprise resource management software from Logo Turkey. A security vulnerability exists in Logo TigerWings ERP version 01.01.00 through versions prior to 3.03.00, which stems from the use of hard-coded credentials and could result in reading sensitive constants in an...
Canonical LXD Arbitrary File Read via Template Injection in Snapshot Patterns
Impact In LXD's instance snapshot creation functionality, the Pongo2 template engine is used in the snapshots.pattern configuration for generating snapshot names. While code execution functionality has not been found in this template engine, it has file reading capabilities, creating a...
Traccar 安全漏洞
Traccar is a Java-based website builder that provides GPS tracking capabilities from Traccar, Inc. in the United States. The software supports more than 170 GPS protocols and more than 1500 models of GPS tracking devices.Traccar can be used with any major SQL database system. It also provides an...
A week in security (September 22 – September 28)
Last week on Malwarebytes Labs: Hackers threaten parents: Get nursery to pay ransom or we leak your child’s data Google and Flo to pay $56 million after misusing users’ health data Neon App pays users to record their phone calls, sells data for AI training updated New SVG-based phishing campaign ...
The vulnerability of the st.c component in the Linux operating system’s kernel allows a hacker to cause a service failure.
The vulnerability of the st.c component in the Linux operating system’s kernel is related to reading data beyond the allowable buffer size. Exploiting this vulnerability can allow an attacker to cause a service failure...
SUSE CVE-2025-59352
Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.1.0, the gRPC API and HTTP APIs allow peers to send requests that force the recipient peer to create files in arbitrary file system locations, and to read arbitrary files. This allows peers to steal...
CLSA-2025-1758823373 libtiff: Fix of 2 CVEs
CVE-2025-8176: fix use after free vulnerability in gethistogram function that prevents proper scanline reading and processing in tools/tiffmedian.c - CVE-2025-8177: fix array overflow in thumbnail generation that could cause buffer overflow when processing malformed TIFF files in tools/thumbnail....
CVE-2025-60020
nncp before 8.12.0 allows path traversal for reading or writing during freqing and file saving via a crafted path in packet data...
UBUNTU-CVE-2025-60020
nncp before 8.12.0 allows path traversal for reading or writing during freqing and file saving via a crafted path in packet data...
PT-2025-39247
Name of the Vulnerable Software and Affected Versions nncp versions prior to 8.12.0 Description The software contains a path traversal flaw that could allow reading or writing to files. This issue occurs during the process of freqing and saving files when handling crafted paths within packet data...
CVE-2025-60020
nncp prior to 8.12.0 is affected by a path traversal vulnerability during freqing and file saving via crafted packet data. Root cause: improper validation of file paths in NNCP’s packet processing. Impact: potential unauthorized reading (and writing) of files. Remediation: upgrade to a fixed vers...
CLSA-2025-1758630391 dovecot: Fix of CVE-2020-12673
CVE-2020-12673: fix reading past buffer...
H2O affected by a deserialization vulnerability
A deserialization vulnerability exists in h2oai/h2o-3 versions = 3.46.0.7, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and...
CVE-2025-6544 Deserialization Vulnerability in h2oai/h2o-3
A deserialization vulnerability exists in h2oai/h2o-3 versions = 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and...
