JetBrains TeamCity Path Traversal Vulnerability

JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A path traversal vulnerability exists in JetBrains...

PT-2025-39242

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel contains a memory leak within the ath12k service ready ext event function. Specifically, the svc rdy ext.mac phy caps memory is not freed in failure scenarios, leading t...

PT-2025-22428 · Ооо "Юзергейт" · Usergate Log Analyzer +4

Уязвимость веб-сервиса xmlrpc программного обеспечения межсетевого экрана UserGate Next-Generation Firewall NGFW, единого центра управления UserGate Management Center UGMC, системы сбора логов UserGate Log Analyzer LogAn связана с недостаточной проверкой входных данных. Эксплуатация уязвимости...

Security-By-Design at the Telco Edge with OSS: Challenges and Lessons Learned

This paper presents our experience, in the context of an industrial R&D project, on securing GENIO, a platform for edge computing on Passive Optical Network PON infrastructures, and based on Open-Source Software OSS. We identify threats and related mitigations through hardening, vulnerability...

Malicious code in @di-sdk/quickselect-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb4f93b792159c059a742b5ea3d59a8038b8e1be1103e430086184a2f3ca3090 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-3564 Malicious code in @di-sdk/quickselect-wasm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fb4f93b792159c059a742b5ea3d59a8038b8e1be1103e430086184a2f3ca3090 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Outlaw cybergang attacking targets worldwide

Introduction In a recent incident response case in Brazil, we dealt with a relatively simple, yet very effective threat focused on Linux environments. Outlaw also known as "Dota" is a Perl-based crypto mining botnet that typically takes advantage of weak or default SSH credentials for its...

Rockwell Automation ThinManager

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to escalate privileges and cause a denial-of-service condition. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:...

Hiding behind a password

What do your passwords say about you? It’s surprisingly personal. User generated passwords can reveal more than you might expect, including frustration, humour, and even how someone feels about their job. My password manager database has over 350 entries. I have chosen or generated all of them wi...

Silicon Series 2 devices 安全漏洞

Silicon Series 2 devices are a family of devices from Silicon Corporation. A security vulnerability exists in Silicon Series 2 devices that stems from a lack of support for DPA countermeasures and could lead to the disclosure of confidential information...

A Novel Cipher for Enhancing MAVLink Security: Design, Security Analysis, and Performance Evaluation Using a Drone Testbed

We present MAVShield, a novel lightweight cipher designed to secure communications in Unmanned Aerial Vehicles UAVs using the MAVLink protocol, which by default transmits unencrypted messages between UAVs and Ground Control Stations GCS. While existing studies propose encryption for MAVLink, most...

CVE-2025-3224

creationtimestamp| type| source ---|---|--- 2025-04-28 19:50:36+00:00| seen| https://infosec.exchange/users/cR0w/statuses/114417325567011461 2025-04-28 20:11:20+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/13732 2025-04-28 23:45:37+00:00| seen|...

Security Bulletin: Denial of Service in Logback used by Apache Zookeeper affect IBM Operations Analytics - Log Analysis (CVE-2023-6481)

Summary There is a potential denial of service in Logback that is used by Apache Zookeeper. This is caused by serialization vulnerability in Logback. Vulnerability Details CVEID:CVE-2023-6481 DESCRIPTION: QOS.ch Sarl Logback is vulnerable to a denial of service, caused by a serialization flaw in...

Security Bulletin: Denial of Service in Apache Commons Compress used by Apache Solr affect IBM Operations Analytics - Log Analysis (CVE-2024-25710, CVE-2024-26308)

Summary There is a potential denial of service in Apache Commons Compress that is used by Apache Solr and IBM Operations Analytics - Log Analysis. This is caused by loop with unreachable exit condition and allocation of resources without limits. Vulnerability Details CVEID:CVE-2024-25710...

SILENT: a New Lens on Statistics in Software Timing Side Channels

Cryptographic research takes software timing side channels seriously. Approaches to mitigate them include constant-time coding and techniques to enforce such practices. However, recent attacks like Meltdown 42, Spectre 37, and Hertzbleed 70 have challenged our understanding of what it means for...

Hybrid Privacy Policy-Code Consistency Check Using Knowledge Graphs and LLMs

The increasing concern in user privacy misuse has accelerated research into checking consistencies between smartphone apps' declared privacy policies and their actual behaviors. Recent advances in Large Language Models LLMs have introduced promising techniques for semantic comparison, but these...

Nazgul Nostromo nhttpd Detection (HTTP)

HTTP based detection of Nazgul Nostromo nhttpd. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious code in freo-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8745e789b7b101fb7ede2f6f26567a39b6ec9522c2f6cad7f182098661442ced The OpenSSF Package Analysis project identified 'freo-design-system' @ 1.0.4 npm as malicious. It is considered malicious because: - The package...

MAL-2025-3399 Malicious code in freo-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8745e789b7b101fb7ede2f6f26567a39b6ec9522c2f6cad7f182098661442ced The OpenSSF Package Analysis project identified 'freo-design-system' @ 1.0.4 npm as malicious. It is considered malicious because: - The package...

Cross-site Request Forgery (CSRF)

Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF through the analysis request action in the Brickfield tool. An attacker can manipulate the state of the application by sending a crafted request that the server accep...