CVE-2025-34438

Summary: CVE-2025-34438 affects AVideo versions prior to 20.1. It is an insecure direct object reference (IDOR) where users with upload permissions can modify the rotation metadata of arbitrary videos because the endpoint verifies upload capability but fails to enforce ownership/administrative ri...

CVE-2025-34438 AVideo < 20.1 IDOR Arbitrary Video Rotation

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...

CVE-2025-34438 AVideo < 20.1 IDOR Arbitrary Video Rotation

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...

EUVD-2025-203956

AVideo versions prior to 20.0 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...

PT-2025-51890

Name of the Vulnerable Software and Affected Versions AVideo versions prior to 20.1 Description AVideo versions prior to 20.1 contain an insecure direct object reference issue. Users with upload permissions can modify the rotation metadata of any video. The ''/video/id'' endpoint verifies upload...

CVE-2025-34438: Authorization Bypass Through User-Controlled Key

AVideo versions prior to 20.1 contain an insecure direct object reference vulnerability allowing users with upload permissions to modify the rotation metadata of any video. The endpoint verifies upload capability but fails to enforce ownership or management rights for the targeted video...

Malicious code in dubbo-js-private-workspace (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d7718e849fa01a112b317438650757b783681fbb3361ec73154005719f6f892 The package dubbo-js-private-workspace was found to contain malicious code. Source: ghsa-malware...

Malicious code in openhands-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3094854e6f43f64c218e6ccdf21f319cff916fef4a412442faccf4b9cd616fe9 The package openhands-frontend was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192594 Malicious code in prod-natwest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cd39817ff9b18b049493c5014a7a0d4f69bd3cf2f4f2a2aebff64453e6ca7519 The package prod-natwest was found to contain malicious code. Source: ghsa-malware efa89a8af6324d2f6726e938c72b64a0b9a1ffbe7788455e95c7ff05752aba50 A...

MAL-2025-192596 Malicious code in starling-api (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 02cb3e1a7a02e3f4215b9e7e7d4f0034bd086085c49a157f37ecf151a9009610 The package starling-api was found to contain malicious code. Source: ghsa-malware a935f963069dc7da39338aa1f718ac33babb8d366d6e23c489a4515b776d6577 A...

Malicious code in elf-stats-fuzzy-wreath-278 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de72f83ee4c58e98151bb08bdad43674b0ee28f24618856adaf402b3e2ddbcd9 The package elf-stats-fuzzy-wreath-278 was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192582 Malicious code in sds-swissid-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfba6a19220522fe10bbf564a1b96c3b7da5de600c03e1e683976b0c6cd36aeb The package sds-swissid-common was found to contain malicious code. Source: ghsa-malware...

Malicious code in paypal-scripts-server-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba55fed7af17fadd676b95594de23778a414dc138beda86d133775a45fdcb03c The package paypal-scripts-server-utils was found to contain malicious code. Source: ghsa-malware...

openSUSE 16 Security Update : exim (openSUSE-SU-2025:20155-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2025:20155-1 advisory. - CVE-2025-53881: Fixed a potential security issue with logfile rotation bsc1246457 Tenable has extracted the preceding description block directly from...

MAL-2025-192562 Malicious code in sd-pay (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9616f3280e84767be7a4d7eb72057a907816c66dba6104915b31df22260c16f4 The package sd-pay was found to contain malicious code. Source: ghsa-malware a8a08228b2c2618675e777b8bd306f5499f39767b26a7e12deb1dc0ce91175b5 Any...

MAL-2025-192563 Malicious code in sd-pay-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7543455a42022174e965eac8f842494f5ad7eb1e0755dfd01035529d63d7a5ff The package sd-pay-ts was found to contain malicious code. Source: ghsa-malware c21a3fe3b0a1df838e4d8b768b5dcc2cf3831bea34c8527fd9e8493ab480bdd7 Any...

Malicious code in camscanner-seo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fd71df3759dceae15fc1ad93919d9a90c9f0bdb044e2e131db061e1e24d253e The package camscanner-seo was found to contain malicious code. Source: ghsa-malware f19e688be1202e28d6c442ecb5e70b4a5e79e7bb33559ff5669948b969324076...

MAL-2025-192564 Malicious code in sdbao-content-report (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 352174ed8ad21b72357fc69c51e395ee7b1ceb75b55603d205bdc8280dfc00b1 The package sdbao-content-report was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192565 Malicious code in sdbao-content-sems (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 050ceeb8145a6cac66b0539a7be8d50c66979cd72b54055f3c49c0c40823fd6b The package sdbao-content-sems was found to contain malicious code. Source: ghsa-malware...

MAL-2025-192547 Malicious code in dfruitmaliciousxmlparser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e75122ef2eea6771fb354b8f8bcf34fa616282e3743af473c0d9ba4eddb29dc6 The package dfruitmaliciousxmlparser was found to contain malicious code. Source: ghsa-malware...