CVE-2025-25595

A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack...

CVE-2025-25595

A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack...

CVE-2025-25595

The Safe App (version a3.0.9 ) by Synerg.cse.iitb is vulnerable to an authentication bypass due to a lack of rate limiting on the login page. This flaw allows attackers to perform brute force attacks to gain unauthorized access. As a remediation, it is recommended to implement rate limiting on th...

Synerg.cse.iitb SAFE 安全漏洞

Synerg.cse.iitb SAFE is a mobile application from Synerg.cse.iitb, Inc. A security vulnerability exists in Synerg.cse.iitb SAFE version a3.0.9, which stems from a lack of rate limiting on the login page and allows an attacker to bypass authentication via brute force...

CVE-2025-25595

A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack...

CVE-2025-25595

A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack...

PT-2025-11632

Name of the Vulnerable Software and Affected Versions Safe App version a3.0.9 Description A lack of rate limiting in the login page allows attackers to bypass authentication via a brute force attack. Recommendations For Safe App version a3.0.9, consider implementing rate limiting on the login pag...

CVE-2025-25595: Improper Restriction of Excessive Authentication Attempts

A lack of rate limiting in the login page of Safe App version a3.0.9 allows attackers to bypass authentication via a brute force attack...

CVE-2025-26865

Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: from 18.12.17 before 18.12.18. It's a regression between 18.12.17 and 18.12.18. In case you use something like that, which is not recommended! For security, only...

png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.

...

AZL-58360 CVE-2025-1550 affecting package keras for versions less than 3.3.3-2

The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, ...

PYSEC-2025-122

The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, ...

PYSEC-2025-122

The Keras Model.loadmodel function permits arbitrary code execution, even with safemode=True, through a manually constructed, malicious .keras archive. By altering the config.json file within the archive, an attacker can specify arbitrary Python modules and functions, along with their arguments, ...

Deserialization of Untrusted Data

Overview keras is a Keras is a high-level neural networks API for Python.. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the loadmodel function, which uses pickle for serialization. An attacker can execute code even if safemode is set to True, by supplyi...

CVE-2025-1550

CVE-2025-1550 concerns a vulnerability in Keras where the Model.load_model function can execute arbitrary code via a malicious .keras archive that alters config.json to load modules/functions with crafted arguments. The issue persists even with safe_mode enabled, enabling potential code execution...

rsync: --safe-links option bypass leads to path traversal

A flaw was found in rsync. When using the --safe-links option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the...

Keras 代码注入漏洞

Keras is a multi-backend deep learning framework open-sourced by Keras. Keras suffers from a code injection vulnerability that stems from allowing execution of arbitrary code via a manually constructed malicious keras archive, even in safe mode...

PT-2025-25842

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A compression buffer overrun issue has been identified in the Linux kernel's LZO compression code. Unlike the decompression code, the compression code did not check for output overruns,...

Jenkins Open Redirect vulnerability

Various features in Jenkins redirect users to partially user-controlled URLs inside Jenkins. To prevent open redirect vulnerabilities, Jenkins limits redirections to safe URLs neither absolute nor scheme-relative/network-path reference. In Jenkins 2.499 and earlier, LTS 2.492.1 and earlier,...

Malicious code in safe-events-service (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c5f0543a7347a07a6c8e5268d63a80e4043f47d8b45500c6c585b72d093b118 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...