50 matches found
CVE-2026-111439: Missing Authorization
在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pgreadbinaryfileblocks 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 isrowdatafile...
CVE-2026-105667
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...
CVE-2026-105667
The J4Care dcm4che system contains a vulnerability where the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application in the default configuration. This lack of authentication allows a remote sender to reassign studies and related workflow records from on...
CVE-2026-105667
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...
CVE-2026-105667 J4Care dcm4che Missing Authentication for Critical Function
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...
EUVD-2026-102895
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...
PT-2026-115620
Name of the Vulnerable Software and Affected Versions affected versions not specified Description In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. This allows a remote sender to reassign studies and related...
CVE-2026-105667: Missing Authentication for Critical Function
In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the sending application. A remote sender can reassign studies and related workflow records from one patient identity to another. The archive's unmerge does not reverse this...
J4Care dcm4chee-arc-light authorization issue vulnerability
The J4Care dcm4chee-arc-light version 5.35.1 has an authorization issue vulnerability. This vulnerability arises from the default configuration, where the HL7 listener accepts ADT^A40 patient merge messages without authenticating the sending application. This allows remote senders to reassign...
Malicious code in demdadf-sadudar-adt (npm)
Source: amazon-inspector 1f06bdbee6f2bac353394061194b9a4c3fff6dbdd3f688b8327be27b463cdb4a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...
CVE-2025-65408
A NULL pointer dereference in the ADTSAudioFileServerMediaSubsession::createNewRTPSink function of Live555 Streaming Media v2018.09.02 allows attackers to cause a Denial of Service DoS via supplying a crafted ADTS file...
EUVD-2020-29012
Malware in sbrugna...
MAL-2025-33112 Malicious code in shopify-adt (npm)
The package shopify-adt was found to contain malicious code...
Malicious code in shopify-adt (npm)
The package shopify-adt was found to contain malicious code...
Security company ADT announces security breach of customer data
Electronic surveillance equipment provider ADT filed a form 8-K with the Security and Exchange Commision SEC to report “a cybersecurity incident during which unauthorized actors illegally accessed certain databases containing ADT customer order information.” An 8-K is a report of unscheduled...
MAL-2022-874 Malicious code in adt-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e95d61525e6c36a296c2d14cd22f5474e59db5ed89e969279b3127d99f61a5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in adt-utils
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in adt-utils (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e95d61525e6c36a296c2d14cd22f5474e59db5ed89e969279b3127d99f61a5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
adt-netzwerk.de Cross Site Scripting vulnerability OBB-2646015
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
A week in security (June 14 – June 20)
Last week on Malwarebytes Labs: How to delete your Instagram account. Working from home? You’re probably being spied on. Another one bites the dust: Avaddon ransomware group shuts down operation. Patch now! Apple fixes in-the-wild iPhone vulnerabilities. Windows 10 to retire in four years or 52...