15011 matches found
Europol, Poland Bust Major DDoS-for-Hire Operation, Arrest 4
Polish authorities arrest 4 behind major DDoS-for-hire sites used in global attacks. Europol, US, Germany, and Dutch forces…...
CVE-2025-0666 BOINC Server Stored XSS Injection in host_venue_action.php
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in BOINC Server allows Stored XSS.This issue affects BOINC Server: through 1.4.7...
CVE-2025-45613
Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload...
Ensure That Rotation Is Enabled for Audit Logs
maxlogfileaction decides the action taken when the size of a log file reaches the upper limit. By default, ROTATE is configured in openEuler, indicating that a new log file is created when the size of a log file reaches the upper limit and the original log file is not deleted. numlogs specifies t...
Ensure That the Drive Space Threshold Is Correct
If the drive space is fully occupied by auditd logs, services may fail to be executed. Therefore, set related configuration items in advance to prevent serious system issues caused by low drive space. The following items in the /etc/audit/auditd.conf file have been configured with default values ...
CVE-2025-45492
Netgear EX8000 V1.0.0.126 is vulnerable to Command Injection via the Iface parameter in the actionwireless function...
MAL-2025-3626 Malicious code in internallib_v921 (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2d85ca5bec57f8bdf71ccddd637037d50c3a8d215c375ab6bcfba881c336175 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3616 Malicious code in commons-net (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01fc821715d3f327c2080415c9a3db5c0f95a8a9f36135b0e6efb377796227da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-3638 Malicious code in node-jwt-simple (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b327dac41c47c206948d7e146a6174435ee74981c5726827f68050b3692060a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Netgear EX8000 安全漏洞
The NETGEAR EX8000 is a tri-band WiFi wireless extender , which is mainly used to extend WiFi coverage, eliminate WiFi dead spots, and provide faster network speeds. The NETGEAR EX8000 suffers from a command injection vulnerability that originates from the Iface parameter in the actionwireless...
PT-2025-19968 · NetGear · Netgear Ex8000
Name of the Vulnerable Software and Affected Versions: Netgear EX8000 version 1.0.0.126 Description: The issue is related to Command Injection via the Iface parameter in the action wireless function. This allows for potential exploitation. Recommendations: For Netgear EX8000 version 1.0.0.126,...
Right-Click Execution - Windows LNK File Special UNC Path NTLM Leak
This module creates a malicious Windows shortcut LNK file that specifies a special UNC path in EnvironmentVariableDataBlock of Shell Link .LNK that can trigger an authentication attempt to a remote server. This can be used to harvest NTLM authentication credentials. When a victim right-click the...
Tenda DAP-1520 安全漏洞
Tenda DAP-1520 is a dual-band wireless access point from Tenda China. The Tenda DAP-1520 suffers from a buffer overflow vulnerability, which originates from the failure of the function setwsaction in the file /dws/api to correctly validate the length of the input data, which can be exploited by a...
CVE-2025-45492
Netgear EX8000 device (V1.0.0.126) is vulnerable to a Command Injection flaw via the Iface parameter in the action_wireless function. This CVE-2025-45492 entry cites a NETWORK‑based vulnerability with low attack complexity, no privileges required, and user interaction not needed, leading to high ...
CVE-2025-45613
Incorrect access control in the component /user/list of Shiro-Action v0.6 allows attackers to access sensitive information via a crafted payload...
MAL-2025-3717 Malicious code in gql-test-client (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc1a4e0775ef3923d488773c12cfaaa56a985b4f914af402f9598ea0d564b883 Any computer that has this package installed or running should be considered...
CVE-2025-45613
CVE-2025-45613 : Shiro-Action v0.6 has an improper access control in the component /user/list , allowing attackers to access sensitive information via a crafted payload. The CVSS v3.1 base score is 7.5 (HIGH) , with Confidentiality impact High and no impact on Availability/Integrity per the provi...
Shiro-Action 安全漏洞
Shiro-Action is a Shiro-based permission management system by zhao jun individual developer. A security vulnerability exists in Shiro-Action v0.6, which stems from improper access control of the component /user/list, which could lead to access to sensitive information...
PT-2025-19781 · Unknown · Shiro-Action
Name of the Vulnerable Software and Affected Versions: Shiro-Action version 0.6 Description: The issue is related to incorrect access control in the component /user/list of Shiro-Action, allowing attackers to access sensitive information via a crafted payload. Recommendations: For Shiro-Action...
