49 matches found
CVE-2025-66910
Turms Server v0.10.0-SNAPSHOT and earlier contains a plaintext password storage vulnerability in the administrator authentication system. The BaseAdminService class caches administrator passwords in plaintext within AdminInfo objects to optimize authentication performance. Upon successful login,...
Turms security vulnerabilities
turms is an instant messaging engine from turms-im open source. A security vulnerability exists in turms AI-Serving module v0.10.0-SNAPSHOT and prior versions, which stems from improper file type validation in the OCR image upload feature and could lead to server-side code execution...
CVE-2025-66911
Turms IM Server versions v0.10.0-SNAPSHOT and earlier are susceptible to a broken access control vulnerability within the user online status query functionality. The root cause is located in the handleQueryUserOnlineStatusesRequest() method of UserServiceController.java, which fails to perform pr...
Turms security vulnerabilities
turms is an instant messaging engine from turms-im open source. A security vulnerability exists in turms v0.10.0-SNAPSHOT and prior versions, which stems from the administrator password being stored in plaintext, which could lead to password disclosure...
CVE-2025-66911
Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest method in UserServiceController.java allows any authenticated user to query the online status, device information, an...
Turms security vulnerabilities
turms is an instant messaging engine from turms-im open source. A security vulnerability exists in turms AI-Serving module v0.10.0-SNAPSHOT and prior versions, which originates from an image decompression bomb and may result in a denial of service...
MAL-2025-8745 Malicious code in @malware-test-knots-ruing-turms-dunno/test-mlw3-knots-ruing-turms-dunno (npm)
The package @malware-test-knots-ruing-turms-dunno/test-mlw3-knots-ruing-turms-dunno was found to contain malicious code...
