CVE-2025-0680

Affected products contain a vulnerability in the device cloud rpc command handling process that could allow remote attackers to take control over arbitrary devices connected to the cloud...

CVE-2025-0680

The CVE-2025-0680 entry concerns New Rock Technologies Cloud Connected Devices suffering an OS command injection vulnerability in the device cloud RPC handling path. Affected software/components are the Cloud Connected Devices’ RPC command processing mechanism; root cause appears to be improper h...

The vulnerability of TeamViewer’s software for remote control of computers allows attackers to increase their privileges.

The vulnerability of TeamViewer’s remote control software relates to the improper elimination of arguments in a command sequence. Exploiting this vulnerability can allow an attacker to enhance their privileges by introducing specially crafted arguments...

PT-2025-3999 · Unknown · Device Cloud

Name of the Vulnerable Software and Affected Versions: Device Cloud affected versions not specified Description: The issue concerns a vulnerability in the device cloud RPC command handling process. This vulnerability could allow remote attackers to take control of arbitrary devices connected to t...

Advisory ROSA-SA-2025-2629

software: jackson-databind 2.9.9.3 OS: ROSA-CHROME packageevrstring: jackson-databind-2.9.9.9.3 CVE-ID: CVE-2019-14540 BDU-ID: 2019-04085 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the FasterXML com.zaxxer.hikari.HikariConfig function of the Java library for grammar parsing JSON files...

Subaru STARLINK Flaw Enabled Remote Tracking and Control of Vehicles

Subaru STARLINK flaw exposed a critical security vulnerability, enabling unauthorized access to vehicle tracking, remote control, and sensitive…...

CVE-2025-22605 Coolify OS Command Injection Vulnerability in SSH Command Generation

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Starting in version 4.0.0-beta.18 and prior to 4.0.0-beta.253, a vulnerability in the execution of commands on remote servers allows an authenticated user to execute arbitrary code on the local...

Malicious code in self-bots-dc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d57d5a05bea1dda9fbc71d4016a47c33f2a89150eef13a97d587db0329a7e7c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ABB FLXEON Controllers

SUMMARY An update is available that resolves a privately reported vulnerability in the product versions listed as affected in this advisory. FLXEON devices are not intended to be internet-facing. A product advisory issued in June 2023 informed customers of this parameter. An attacker can...

PT-2025-3122 · Unknown · Rar Extractor - Unarchiver

Name of the Vulnerable Software and Affected Versions: RAR Extractor - Unarchiver Free and Pro version 6.4.0 Description: The issue allows local attackers to inject arbitrary code, potentially leading to remote control and unauthorized access to sensitive user data via the exploit combined.dylib...

PT-2025-2963 · Unknown · In Phiewer

Name of the Vulnerable Software and Affected Versions: In Phiewer version 4.1.0 Description: The issue is related to a dylib injection that leads to command execution, allowing attackers to inject a dylib file. This potentially leads to remote control and unauthorized access to sensitive user dat...

CVE-2024-53407

In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorized access to sensitive user data...

Malicious code in zqdl55516 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2a336fa23aa2b0c5e683c34c2273bc1e583be062a3d0100ca08d99ef9214601 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

FireScam Android Malware Poses as Telegram Premium to Steal Data and Control Devices

An Android information stealing malware named FireScam has been found masquerading as a premium version of the Telegram messaging app to steal data and maintain persistent remote control over compromised devices. "Disguised as a fake 'Telegram Premium' app, it is distributed through a...

CVE-2023-4617 Gaining remote control over Govee devices

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in...

CVE-2023-4617

CVE-2023-4617 describes an incorrect authorization vulnerability in the Govee Home application (Android and iOS) that is exploitable via the HTTP POST method. A remote attacker can manipulate the request fields—device , sku , and type —to gain control of devices owned by other users. Affected ver...

CVE-2023-4617 Gaining remote control over Govee devices

Incorrect authorization vulnerability in HTTP POST method in Govee Home application on Android and iOS allows remote attacker to control devices owned by other users via changing "device", "sku" and "type" fields' values. This issue affects Govee Home applications on Android and iOS in...

Malicious code in shyftportal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c420e2c055c4dac21abe5aa3deacde16aef6dcd57335d4244adffc4346365a2e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CERT-UA Warns of Phishing Attacks Targeting Ukraine's Defense and Security Force

The Computer Emergency Response Team of Ukraine CERT-UA has warned of a new set of cyber attacks that it said were aimed at defense companies in the country as well as its security and defense forces. The phishing attacks have been attributed to a Russia-linked threat actor called UAC-0185 aka...

CVE-2024-53938

An issue was discovered in Victure RX1800 WiFi 6 Router software ENV1.0.0r12110933, hardware 1.0 devices. The TELNET service is enabled by default and exposed over the LAN. The root account is accessible without a password, allowing attackers to achieve full control over the router remotely witho...