Kibana 8.15.x < 8.17.3 Prototype Pollution

According to its self-reported version number, the Kibana application running on the remote host is 8.15.x prior to 8.17.3. It is, therefore, affected by a code execution via a crafted file upload and specifically crafted HTTP requests Note that the scanner has not tested for these issues but has...

MAL-2025-2225 Malicious code in layouts-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 668d31349d49bb3ffdf31cb641b2829be6ffcae92877d17241a593565a0dddb5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-47109 IBM Sterling File Gateway information disclosure

IBM Sterling File Gateway 6.0.0.0 through 6.1.2.6 and 6.2.0.0 through 6.2.0.3 UI could disclosure the installation path of the server which could aid in further attacks against the system...

MAL-2025-3008 Malicious code in tlsclient3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 612e1a598a61304a9ae3550acb835ef5962f596bb74e857c2a035ba090e57dc4 Obfuscated code starts a multi-stage infection --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...

CVE-2025-27840

Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 Write memory...

PT-2025-10448 · Thinkware · Thinkware Car Dashcam F800 Pro

Name of the Vulnerable Software and Affected Versions: Thinkware Car Dashcam F800 Pro up to 20250226 Description: A vulnerability was found in the Thinkware Car Dashcam F800 Pro, affecting some unknown processing of the file /tmp/hostapd.conf of the component Configuration File Handler. The...

BIT-JENKINS-2025-27623

Jenkins 2.499 and earlier, LTS 2.492.1 and earlier does not redact encrypted values of secrets when accessing config.xml of views via REST API or CLI, allowing attackers with View/Read permission to view encrypted values of secrets...

PT-2025-28031 · Protobuf +1 · Protobuf +1

Name of the Vulnerable Software and Affected Versions: protobuf crate for Rust versions prior to 3.7.2 Description: The issue allows uncontrolled recursion in the protobuf::coded input stream::CodedInputStream::skip group function when parsing unknown fields in untrusted input. This can occur due...

CVE-2025-24796

Collabora Online is a collaborative online office suite based on LibreOffice. Macro support is disabled by default in Collabora Online, but can be enabled by an administrator. Collabora Online typically hosts each document instance within a jail and is allowed to download content from locations...

Malware Infects Linux and macOS via Typosquatted Go Packages

Socket exposes a typosquatting campaign delivering malware to Linux and macOS systems via malicious Go packages. Discover the…...

Linux Distros Unpatched Vulnerability : CVE-2024-5594

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - OpenVPN before 2.6.11 does not santize PUSHREPLY messages properly which attackers can use to inject unexpected arbitrary data into third-party executables or...

Linux Distros Unpatched Vulnerability : CVE-2024-49982

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - aoe: fix the potential use-after-free problem in more places For fixing CVE-2023-6270, f98364e92662 aoe: fix the potential use-after-free problem in aoecmdcfgpk...

Linux Distros Unpatched Vulnerability : CVE-2024-50144

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/xe: fix unbalanced rpm put with fencefini Currently we can call fencefini twice if...

Linux Distros Unpatched Vulnerability : CVE-2024-50037

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/fbdev-dma: Only cleanup deferred I/O if necessary Commit 5a498d4d06d6 drm/fbdev-dma: Onl...

Linux Distros Unpatched Vulnerability : CVE-2024-49975

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uprobes: fix kernel info leak via uprobes vma xoladdvma maps the uninitialized page allocated by createxolarea into userspace. On some architectures x86 this...

Linux Distros Unpatched Vulnerability : CVE-2024-6991

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Use after free in Dawn in Google Chrome prior to 127.0.6533.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromiu...

OpenAdmin 0.3.4 Cross Site Request Forgery

Cross site request forgery in the Users and Change Root Password functions in OpenAdmin version 0.3.4 allows remote attackers to perform attacks enabling unauthorized actions that could lead to privilege escalation. Exploit Title: OpenAdmin 0.3.4 - Multiple CSRF Vulnerabilities Date: Nov 8, 2024...

Linux Distros Unpatched Vulnerability : CVE-2024-57823

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Raptor RDF Syntax Library through 2.0.16, there is an integer underflow when normalizing a URI with the turtle parser in raptorurinormalizepath. CVE-2024-578...

Linux Distros Unpatched Vulnerability : CVE-2014-9236

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cross-site scripting XSS vulnerability in php/editphotos.php in Zoph aka Zoph Organizes Photos 0.9.1 and earlier allows remote attackers to inject arbitrary web...

Linux Distros Unpatched Vulnerability : CVE-2025-23016

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - FastCGI fcgi2 aka fcgi 2.x through 2.4.4 has an integer overflow and resultant heap-based buffer overflow via crafted nameLen or valueLen values in data to the...