sonic-server 安全漏洞

Sonic-server is a mobile device remote debugging and automated testing platform open source by Sonic Cloud Org. Versions of sonic-server 2.0.0 and earlier contain security vulnerabilities. These vulnerabilities stem from improper handling of parameter types in the Upload function of the File Uplo...

MAL-2026-2180 Malicious code in sonic-config-engine (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2385b46fee4fb7241c2f3f692934017f39660c9694b98b92cbe3dae6555e5b05 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Sonic-go-brrr-CTF-exploit-Code

This Code customized for Solve Cyber Talent CTF Sonic go...

CVE-2019-12968

A vulnerability was found in the Sonic Robo Blast 2 SRB2 plugin EPVersions 9 to 11 inclusive distributed with Doomseeker 1.1 and 1.2. Affected plugin versions did not discard IP packets with an unnaturally long response length from a Sonic Robo Blast 2 master server, allowing a remote attacker to...

CVE-2025-15414

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

EUVD-2025-206134

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing manipulation of the argument uri can lead to server-side request forgery. The attack may be launched remotely...

CVE-2025-15414

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

CVE-2025-15414 go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

CVE-2025-15414 go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

CVE-2025-15414

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

CVE-2025-15414

The CVE-2025-15414 issue affects go-sonic up to version 1.1.4, specifically the FetchTheme function in service/theme/git_fetcher.go of the Theme Fetching API. The root cause is manipulation of the uri argument that enables server-side request forgery (SSRF), with the attack potentially executable...

PT-2026-1030

Name of the Vulnerable Software and Affected Versions go-sonic versions up to 1.1.4 Description A server-side request forgery issue exists in the Theme Fetching API of go-sonic. The flaw is located in the FetchTheme function within the service/theme/git fetcher.go file. Manipulation of the uri...

Sonic 代码问题漏洞

Sonic is a go-sonic open source high performance blogging system developed using golang. A code issue vulnerability exists in Sonic 1.1.4 and earlier versions, which stems from the incorrect operation of the parameter uri in the FetchTheme function in the Theme Fetching API component file...

Microsoft Azure 安全漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A security vulnerability exists in Microsoft Azure that stems from a stack-based buffer overflow in the Software for Open Networking in the Cloud SONiC allowing an unauthorized attacker ...

Malicious code in sonic-kos-fug (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 84822e962ef693c1564066dab1c0453eeecd071c49e6d8475fd8c05e3599371d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-ijos-afh (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a52dab8981a3f6f493c8c7fb832a1520fa887b6450486664f13d5f3477dc6248 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kat-ihu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401662b1dcf1ce86735ff7b77e3283e697224dfa160dc13d35fa76af925b1399 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-ijos-afafih (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a2be54eab7252a37628584d84d903c5cea37ba4a30bfb84ed1f30beaa82a9b7 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-ks-fudiaja (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1f765b984dfe3c6ef52816e23955230a2831402a1ad915d173b1df690ca3d983 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kuig-tgacedcav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e37b5ecb542a413c9b8b727f4bca98f634eb0b792f47d6522997f486487b947e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...