Exploit for CVE-2024-47875

CVE-2025-22131 • PhpSpreadsheet HTML Writer XSS PoC Over...

Incorrect Implementation of Authentication Algorithm

Overview esphome is a Make creating custom firmwares for ESP32/ESP8266 super easy. Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm in the webserver authentication process. An attacker can gain unauthorized access to web server functionality...

PT-2025-92: Local Privilege Escalation in IDrive

The vulnerability was identified in IDrive, version 4.0.0.38. The discovered vulnerability allows an attacker to escalate privileges from a normal user to root. Vulnerability status: Confirmed by vendor Date of vulnerability remediation: 02.09.2025 Recommendations: Update to version MacVersion...

Security Bulletin: SSH servers which implement file transfer protocols are vulnerable, which affects IBM watsonx.data

Summary UsSSH servers which implement file transfer protocols are vulnerable to a denial of service attack from clients which complete the key exchange slowly, or not at all, causing pending content to be read into memory, but never transmitted. These can affect watsonx.data. Vulnerability Detail...

Security Bulletin: Due to use of Connect2id Nimbus JOSE+JWT, IBM Watson Studio in Cloud Pak for Data is affected by denial of service

Summary Connect2id Nimbus JOSE+JWT is used by Watson Studio in Cloud Pak for Data. Vulnerability Details CVEID:CVE-2023-52428 DESCRIPTION: In Connect2id Nimbus JOSE+JWT before 9.37.2, an attacker can cause a denial of service resource consumption via a large JWE p2c header value aka iteration cou...

Malicious Package

Overview polyfliof92 is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

Exploit for Use After Free in Google Chrome

STIG – Microsoft Edge Chromium 139.0.3405.125 Remote Code...

CVE-2023-7309

A path traversal vulnerability exists in the Dahua Smart Park Integrated Management Platform also referred to as the Dahua Smart Campus Integrated Management Platform, affecting the SOAP-based GIS bitmap upload interface. The flaw allows unauthenticated remote attackers to upload arbitrary files ...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in Blind SQL Injection

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of Blind SQL Injection Vulnerability Details CVEID:CVE-2025-0165 DESCRIPTION: IBM watsonx Orchestrate Cartridge for IBM Cloud Pak for Data is vulnerable to SQL injection. A remote attacker could send specially crafted SQL...

Security Bulletin: Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly, which affects IBM watsonx.data

Summary Hive creates a credentials file to a temporary directory in the file system with permissions 644 by default when the file permissions are not set explicitly. Any unauthorized user having access to the directory can read the sensitive information written into this file. These can affect...

PT-2025-35258

Name of the Vulnerable Software and Affected Versions: File Station 5 versions prior to 5.5.6.4907 Description: A NULL pointer dereference issue exists in File Station 5. A remote attacker gaining a user account can exploit this to launch a denial-of-service DoS attack. Recommendations: Update to...

Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in rsync [CVE-2024-12747]

Summary IBM Watson Speech Services Cartridge is vulnerable to a sensitive information exposure in rsync, due to a race condition during rsync's handling of symbolic links CVE-2024-12747. Rsync is used as part of our Java Microservices. This vulnerabilitiy has been addressed. Please read the detai...

CVE-2025-57756 Contao discloses sensitive information in the front end search index

Contao is an Open Source CMS. In versions starting from 4.9.14 and prior to 4.13.56, 5.3.38, and 5.6.1, protected content elements that are rendered as fragments are indexed and become publicly available in the front end search. This issue has been patched in versions 4.13.56, 5.3.38, and 5.6.1. ...

Security Bulletin: IBM Transformation Advisor is affected by vulnerability found in Node.js (CVE-2025-7338)

Summary There is a vulnerability in Node.js used by IBM Transformation Advisor, The issues have been addressed in an update. Vulnerability Details CVEID:CVE-2025-7338 DESCRIPTION: Multer is a node.js middleware for handling multipart/form-data. A vulnerability that is present starting in version...

Security Bulletin: IBM Guardium Data Protection is affected by an SQL Injection via username vulnerability (CVE-2024-55906).

Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2024-55906 DESCRIPTION: IBM Security Guardium is vulnerable to SQL injection. A remote attacker could send specially crafted SQL statements, which could allow the attacker to view,...

CVE-2025-34163

Dongsheng Logistics Software exposes an unauthenticated endpoint at /CommMng/Print/UploadMailFile that fails to enforce proper file type validation and access control. An attacker can upload arbitrary files, including executable scripts such as .ashx, via a crafted multipart/form-data POST reques...

CVE-2025-34521

A reflected cross-site scripting XSS vulnerability exists in the web interface of the Arcserve Unified Data Protection UDP, where unsanitized user input is improperly reflected in HTTP responses. This flaw allows remote attackers with low privileges to craft malicious links that, when visited by...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the /sys-api/role/update interface. An attacker can access sensitive data or disrupt normal system operations by sending specially crafted requests. Remediation Upgrade...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in cryptography-44.0.0-cp37-abi3-macosx_10_9_universal2.whl

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of cryptography-44.0.0-cp37-abi3-macosx109universal2.whl Vulnerability Details CVEID:CVE-2024-12797 DESCRIPTION: Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the...

Embeded Malicious Code

Overview @nx/workspace is an AI-first build platform that connects everything from your editor to CI. Helping you deliver fast, without breaking things. Affected versions of this package are vulnerable to Embeded Malicious Code through a malicious postinstall script that triggers a file named...