2899 matches found
Security Debt in Practice: Nuanced Insights from Practitioners
With the increasing reliance on software and automation nowadays, tight deadlines, limited resources, and prioritization of functionality over security can lead to insecure coding practices. When not handled properly, these constraints cause unaddressed security vulnerabilities to accumulate over...
PT-2025-29612
Name of the Vulnerable Software and Affected Versions Conjur OSS versions 1.19.5 through 1.22.0 Secrets Manager, Self-Hosted versions 13.1 through 13.6 Description Conjur provides secrets management and application identity for infrastructure. A malformed regular expression allows an attacker...
MAL-2025-5855 Malicious code in @rev-security/identity-rev (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 66d1691255abf05791c57f211c1a1d8e8e2509911be9503c3a9ef52fab9e1898 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
"Is It Always Watching? Is It Always Listening?" Exploring Contextual Privacy and Security Concerns toward Domestic Social Robots
Equipped with artificial intelligence AI and advanced sensing capabilities, social robots are gaining interest among consumers in the United States. These robots seem like a natural evolution of traditional smart home devices. However, their extensive data collection capabilities, anthropomorphic...
IBM WebSphere eXtreme Scale 8.6.1 < 8.6.1.6 (7239492)
The version of IBM WebSphere eXtreme Scale installed on the remote host is prior to 8.6.1.6. It is, therefore, affected by multiple vulnerabilities as referenced in the 7239492 advisory. - Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of...
FreeBSD : GnuTLS -- multiple vulnerabilities (c3e1df74-5e73-11f0-95e5-74563cf9e4e9)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the c3e1df74-5e73-11f0-95e5-74563cf9e4e9 advisory. Daiki Ueno reports: Tenable has extracted the preceding description block directly from the...
CVE-2025-1220
In PHP versions:8.1. before 8.1.33, 8.2. before 8.2.29, 8.3. before 8.3.23, 8.4. before 8.4.10 some functions like fsockopen lack validation that the hostname supplied does not contain null characters. This may lead to other functions like parseurl treat the hostname in different way, thus openin...
FreeBSD : libxslt -- unmaintained, with multiple unfixed vulnerabilities (b0a3466f-5efc-11f0-ae84-99047d0a6bcc)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the b0a3466f-5efc-11f0-ae84-99047d0a6bcc advisory. Alan Coopersmith reports: On 6/16/25 15:12, Alan Coopersmith wrote: BTW, users of libxml2 may...
CVE-2025-6395
creationtimestamp| type| source ---|---|--- 2025-07-11 19:37:31+00:00| seen| https://seclists.org/oss-sec/2025/q3/34 2025-09-10 09:29:04+00:00| seen| https://gist.github.com/Darkcrai86/b87e14a5bc55e398469cc37b642c3272 2026-01-21 21:18:16+00:00| seen|...
CVE-2025-6742
The SureForms – Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.7.3 via the use of fileexists in the deleteentryfiles function without restriction on the path provided. This makes it possible for...
CVE-2025-50109 Emerson ValveLink Products Cleartext Storage of Sensitive Information in Memory
Emerson ValveLink Products store sensitive information in cleartext within a resource that might be accessible to another control sphere...
GHSA-54XV-94QV-2GFG @pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation
Summary The expression evaluation feature in pdfme 5.2.0 to 5.4.0 contains critical vulnerabilities allowing sandbox escape leading to XSS and prototype pollution attacks. Details 1. Sandbox Escape Leading to XSS The expression evaluator's sandbox can be bypassed to execute arbitrary JavaScript...
CVE-2023-52236
A vulnerability has been identified in RUGGEDCOM i800 All versions, RUGGEDCOM i801 All versions, RUGGEDCOM i802 All versions, RUGGEDCOM i803 All versions, RUGGEDCOM M2100 All versions, RUGGEDCOM M2200 All versions, RUGGEDCOM M969 All versions, RUGGEDCOM RMC30 All versions, RUGGEDCOM RMC8388 V4.X...
What Security Leaders Need to Know About AI Governance for SaaS
Generative AI is not arriving with a bang, it’s slowly creeping into the software that companies already use on a daily basis. Whether it is video conferencing or CRM, vendors are scrambling to integrate AI copilots and assistants into their SaaS applications. Slack can now provide AI summaries o...
SAP NetWeaver AS Java Multiple Vulnerabilities (July 2025)
SAP NetWeaver Application Server for Java is affected by multiple vulnerabilities, including the following: - A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful...
MAL-2025-6488 Malicious code in cryptob (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 d0ee1f01fb1d9fe3ac1d88bec06c858d0c3e33f2531e7ca1afb30177f0b85e84 Importing starts an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-07-cryptoo Reasons based...
RAG Safety: Exploring Knowledge Poisoning Attacks to Retrieval-Augmented Generation
Retrieval-Augmented Generation RAG enhances large language models LLMs by retrieving external data to mitigate hallucinations and outdated knowledge issues. Benefiting from the strong ability in facilitating diverse data sources and supporting faithful reasoning, knowledge graphs KGs have been...
Microsoft Windows Multiple Vulnerabilities (KB5062557)
This host is missing an important security update according to Microsoft KB5062557 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
Microsoft Windows Multiple Vulnerabilities (KB5062560)
This host is missing an important security update according to Microsoft KB5062560 SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
