7508 matches found
DRUPAL-CONTRIB-2025-059
The Events Log Track module enables you to log specific events on a Drupal site. The module doesn't sufficiently mitigate resource consumption for certain requests which allows a Denial of Service attack...
CVE-2025-0020
Rejected reason: “This CVE ID is Rejected and will not be used. As the CNA of record ESRI has rejected this CVE as it is not a vulnerability”...
CVE-2025-0020
CVE-2025-0020 is marked as rejected in the initial entry, but connected documents describe a vulnerability in ArcGIS’s client_credentials OAuth 2.0 API implementation: it allows undocumented, custom token expiration, enabling privilege abuse and manipulation of hidden fields/configuration. Affect...
PT-2025-21140 · Esri · Arcgis
Name of the Vulnerable Software and Affected Versions: ArcGIS affected versions not specified Description: The ArcGIS client credentials OAuth 2.0 API implementation does not adhere to the RFC/standards, allowing a requestor to request an undocumented, custom token expiration from ArcGIS. This...
Important: libsoup
Issue Overview: A flaw was found in libsoup, where the soupheadersparserequest function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server. CVE-2025-32906 A flaw was found in libsoup. The implementation of...
Siemens Mendix OIDC SSO 安全漏洞
Siemens Mendix OIDC SSO is an enterprise-class unified identity solution based on the OIDC protocol from Siemens Germany. A security vulnerability exists in Siemens Mendix OIDC SSO that stems from improper assignment of token access privileges, which could lead to privilege abuse...
Malicious code in abuse-ui-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52f0ac6f86a904aee580160f8eb62130b70b4e6326a6e843cdc9977622b50add Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3755 Malicious code in abuse-ui-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52f0ac6f86a904aee580160f8eb62130b70b4e6326a6e843cdc9977622b50add Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Initial Access Brokers Target Brazil Execs via NF-e Spam and Legit RMM Trials
Cybersecurity researchers are warning of a new campaign that's targeting Portuguese-speaking users in Brazil with trial versions of commercial remote monitoring and management RMM software since January 2025. "The spam message uses the Brazilian electronic invoice system, NF-e, as a lure to entic...
curl: curl_easy_header runs at O(N) or worse and can be abused to use minute(s) of CPU time
Summary: The implementation of curleasyheader can be abused by a malicious server that puts all headers under a single key. Imagine a server response like: HTTP/1.1 200 OK a: a: a: a: repeat until MAXHTTPRESPHEADERSIZE bytes are used As a developer, if you want to loop through the headers you do...
Do Not Allow Unused Users
If service-irrelevant users exist in the system, attackers may use them to launch attacks. Only users required by services are retained in the system. Other users used for installation, deployment, commissioning, verification, and fault locating must be deleted. By default, unused users do not...
Third Parties and Machine Credentials: The Silent Drivers Behind 2025's Worst Breaches
It wasn't ransomware headlines or zero-day exploits that stood out most in this year's Verizon 2025 Data Breach Investigations Report DBIR — it was what fueled them. Quietly, yet consistently, two underlying factors played a role in some of the worst breaches: third-party exposure and machine...
PYSEC-2025-179
OpenCTI is an open cyber threat intelligence CTI platform. Prior to version 6.4.11 any user with the capability manage customizations can execute commands on the underlying infrastructure where OpenCTI is hosted and can access internal server side secrets by misusing the web-hooks. Since the...
CVE-2025-2605
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most...
CVE-2025-2605
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most...
CVE-2025-2605
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most...
CVE-2025-2605 Authenticated command injection
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most...
CVE-2025-2605 Authenticated command injection
Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Honeywell MB-Secure allows Privilege Abuse. This issue affects MB-Secure: from V11.04 before V12.53 and MB-Secure PRO from V01.06 before V03.09.Honeywell also recommends updating to the most...