CVE-2025-12922

A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xmlfile results in path traversal. The attack can be initiated remotely. T...

CVE-2025-12922 OpenClinica Community Edition CRF Data Import ImportCRFData path traversal

A vulnerability was found in OpenClinica Community Edition up to 3.12.2/3.13. This affects an unknown part of the file /ImportCRFData?action=confirm of the component CRF Data Import. Performing manipulation of the argument xmlfile results in path traversal. The attack can be initiated remotely. T...

CVE-2025-12922

CVE-2025-12922 affects OpenClinica Community Edition up to 3.12.2/3.13. The vulnerability resides in the CRF Data Import component, specifically the file path /ImportCRFData?action=confirm, where manipulation of the xml_file argument leads to a path traversal. The issue is exploitable remotely an...

PT-2025-45607

Name of the Vulnerable Software and Affected Versions Looker Studio versions prior to 07 July 2025 Description A SQL injection issue was identified in Looker Studio, potentially allowing unauthorized data exfiltration from BigQuery data sources. An attacker could create a malicious report with...

PT-2025-46160

Name of the Vulnerable Software and Affected Versions Triofox versions prior to 16.7.10368.56560 Description Triofox is vulnerable to an Improper Access Control flaw that allows access to initial setup pages even after setup is complete. This vulnerability, designated CVE-2025-12480, allows...

Apple macOS Sequoia Permission Issue Vulnerability (CNVD-2025-29330)

Apple macOS Sequoia is an operating system announced by Apple on June 10, 2024 at the WWDC24 developer conference. Apple macOS Sequoia has a privilege issue vulnerability that can be exploited by attackers to cause an application to access sensitive user data...

PT-2025-45609

Name of the Vulnerable Software and Affected Versions Looker Studio affected versions not specified Description An improper privilege management issue was identified in Looker Studio, affecting all JDBC-based connectors. A Looker Studio user with report view access could create a copy of a report...

MAL-2025-49622 Malicious code in yanti-bubur12-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a391f7cdaa166ba3c172b70dcf5320801b626982ea988166a97aa28ee678f9c The package yanti-bubur12-riris was found to contain malicious code...

MAL-2025-49474 Malicious code in zain-lepet73-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0b7970e8ec39649fc7c2c4c7cda589cbeec9f1b93c70fc98b8e9ebb6ba570e4c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-49437 Malicious code in study-lab-e52 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 50708d98a0ca76a26e4b2f4ba435e4dec98c82e20f6fa80926cfd924adea2e06 The package study-lab-e52 was found to contain malicious code...

Malicious code in finalmoyloyt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55125b342b47dcefababdb74478820644fd9f4e19a428dd6e84e7af021cd1bf1 The package finalmoyloyt was found to contain malicious code...

GHSA-PWHC-RPQ9-4C8W vulnerabilities

Vulnerabilities for packages: kubevela, eksctl, kaniko, opa, helm-mapkubeapis, chartmuseum, spegel, ctop, newrelic-infrastructure-agent, helm-push, trivy, cilium-cli, falco-no-driver, nerdctl, melange, opa-envoy, zarf, k3s, neuvector-scanner, kubescape-operator, syft, cluster-api-helm-controller,...

CVE-2025-63717

creationtimestamp| type| source ---|---|--- 2025-11-07 21:35:17+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3m52zultlcb2j...

CVE-2022-50592

Advantech iView versions prior to v5.7.04 build 6425 contain a vulnerability within the SNMP management tool that allows for remote attackers to bypass authentication checks and reach a SQL injection vulnerability within the ‘getInventoryReportData’ parameter to the ‘NetworkServlet’ endpoint...

Malicious code in payouts-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector becec2c60d20e2a05077102cbd8851073afafea45cec70202a05d3af32bb3ccc The package payouts-report was found to contain malicious code. Source: ossf-package-analysis...

EUVD-2025-38321

Malicious code in payouts-report npm...

MAL-2025-49391 Malicious code in payouts-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector becec2c60d20e2a05077102cbd8851073afafea45cec70202a05d3af32bb3ccc The package payouts-report was found to contain malicious code. Source: ossf-package-analysis...

Google Launches New Maps Feature to Help Businesses Report Review-Based Extortion Attempts

Google on Thursday said it's rolling out a dedicated form to allow businesses listed on Google Maps to report extortion attempts made by threat actors who post inauthentic bad reviews on the platform and demand ransoms to remove the negative comments. The approach is designed to tackle a common...

PT-2025-45480

Name of the Vulnerable Software and Affected Versions SourceCodester PQMS version 1.0 Description A SQL injection issue exists in the Patient Queue Management System. The api patient schedule.php endpoint is affected because the appointmentID parameter does not receive proper sanitization,...

CVE-2025-64179

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. In versions 1.69.0 and below, missing authentication in the /api/v1/usage-report/summary endpoint allows anyone to retrieve aggregate API usage counts. While no sensitive data is disclosed, the endpoint may...