MAL-2024-11543 Malicious code in bytebs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 443278bc9421868cfa1431a267241ecb62582b57285a1d5f093d7109e2d12288 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

MAL-2024-11731 Malicious code in torchvisions (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 51134ba41129052e6c7163c273094867918aff7ffc9579a3834f3febb74b44d7 A campaign of probably pentest packages flooding PYPI. Installing the package or importing the module triggers reporting basic info like hostname, path and the...

Exploit for CVE-2024-51132

CVE-2024-51132-POC Vulnerability Type XXE - XML Externa...

Exploit for SQL Injection in Ultimatemember Ultimate_Member

CVE-2024-1071 Exploit Script 🚀 🌟 Disclaimer This Proof o...

Exploit for Missing Authentication for Critical Function in Cyberpanel

CVE-2024-51567 Exploit Script CVE-2024-51567 is a Python...

Researchers Uncover Python Package Targeting Crypto Wallets with Malicious Code

Cybersecurity researchers have discovered a new malicious Python package that masquerades as a cryptocurrency trading tool but harbors functionality designed to steal sensitive data and drain assets from victims' crypto wallets. The package, named "CryptoAITools," is said to have been distributed...

CVE-2024-50334

creationtimestamp| type| source ---|---|--- 2024-10-29 17:17:22+00:00| seen| https://t.me/cvedetector/9337 2025-07-05 02:03:26+00:00| confirmed| https://github.com/projectdiscovery/nuclei-templates/tree/main/http/cves/2024/CVE-2024-50334.yaml 2025-07-07 21:02:22+00:00| seen|...

GO-2024-3207 Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito

Permissive Regular Expression in tacquito in github.com/facebookincubator/tacquito...

CVE-2024-5764

Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database SMTP or HTTP proxy credentials, user tokens, tokens, among others. The affected versions relied on ...

CVE-2024-5764 Nexus Repository 3 - Static hard-coded encryption passphrase used by default

Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database SMTP or HTTP proxy credentials, user tokens, tokens, among others. The affected versions relied on ...

CVE-2024-5764 Nexus Repository 3 - Static hard-coded encryption passphrase used by default

Use of Hard-coded Credentials vulnerability in Sonatype Nexus Repository has been discovered in the code responsible for encrypting any secrets stored in the Nexus Repository configuration database SMTP or HTTP proxy credentials, user tokens, tokens, among others. The affected versions relied on ...

CVE-2024-5764

CVE-2024-5764 affects Nexus Repository 3.x (3.0.0–3.72.0). It arises from a static hard-coded encryption passphrase used by the PasswordCipher to encrypt secrets in the Nexus configuration database (SMTP/HTTP proxy credentials, tokens, etc.). An administrator could set an alternate passphrase at ...

Sonatype Nexus Repository 安全漏洞

Sonatype Nexus Repository is a repository manager from Sonatype, Inc. that is used to manage, store, and distribute software, among other things. A security vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.72.0 that stems from the use of hard-coded credentials...

Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepository

A deserialization of untrusted data flaw was found in the Apache Camel CassandraQL Component AggregationRepository. The affected versions of Apache Camel are vulnerable to unsafe deserialization, where, under specific conditions, it is possible to deserialize a malicious payload...

Credentials Exposure

github.com/argoproj/argo-cd is vulnerable to Credentials Exposure. The vulnerability is due to the inappropriate handling and logging of sensitive authentication information within pod logs when connected to a Helm OCI repository with authentication enabled, allows individuals with access to the...

MAL-2024-11600 Malicious code in ggghhhrrr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 28a551f5605f075f623a22621731c74e18e92b9e3eafef6d876457301fbeee20 According to the description, packages should demonstrate the dependency confusion attack. The realisation is, in fact, a spamming with packages having as the...

Malicious code in pysoltoken (PyPI)

--- -= Per source details. Do not edit below this line.=-...

BIT-GITLAB-2024-9623 Incorrect Authorization in GitLab

An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4 prior to 17.4.2, which allows deploy keys to push to an archived repository...

Snipe-IT remote code execution

Snipe-IT before 7.0.10 allows remote code execution associated with cookie serialization when an attacker knows the APPKEY. This is exacerbated by .env files, available from the product's repository, that have default APPKEY values...

CVE-2024-6971

A path traversal vulnerability exists in the parisneo/lollms-webui repository, specifically in the lollmsfilesystem.py file. The functions addragdatabase, togglemountragdatabase, and vectorizefolder do not implement security measures such as sanitizepathfromendpoint or sanitizepath. This allows a...