7128 matches found
CVE-2025-15106 getmaxun Authentication Endpoint auth.ts router.get improper authorization
A weakness has been identified in getmaxun maxun up to 0.0.28. The affected element is the function router.get of the file server/src/routes/auth.ts of the component Authentication Endpoint. Executing manipulation can lead to improper authorization. The attack can be executed remotely. The exploi...
EUVD-2025-205469
A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Performing manipulation of the argument apikey results in use of hard-coded cryptographic key . Remote exploitation of the attack...
CVE-2025-15105
A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Performing manipulation of the argument apikey results in use of hard-coded cryptographic key . Remote exploitation of the attack...
CVE-2025-15105
CVE-2025-15105 affects getmaxun maxun up to version 0.0.28. The vulnerability is in the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts, where manipulation of the argument api_key results in the use of a hard-coded cryptographic key. This enables remote exploitation and is described a...
CVE-2025-15105 getmaxun auth.ts hard-coded key
A security flaw has been discovered in getmaxun maxun up to 0.0.28. Impacted is an unknown function of the file /getmaxun/maxun/blob/develop/server/src/routes/auth.ts. Performing manipulation of the argument apikey results in use of hard-coded cryptographic key . Remote exploitation of the attack...
CVE-2025-68948
SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode ...
CVE-2025-68948 SiYuan: Information Disclosure and Authentication Bypass via Hardcoded Session Secret
SiYuan is self-hosted, open source personal knowledge management software. In versions 3.5.1 and prior, the SiYuan Note application utilizes a hardcoded cryptographic secret for its session store. This unsafe practice renders the session encryption ineffective. Since the sensitive AccessAuthCode ...
Malicious code in ing-feat-auth-idin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55080ac00ebd2c937db80d93324226b3fbb9dda607619f44d94dd4c09a8ba0fc The package ing-feat-auth-idin was found to contain malicious code. Source: ghsa-malware...
EUVD-2025-205385
Malicious code in ing-feat-auth-idin npm...
MAL-2025-192933 Malicious code in ing-feat-auth-idin (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55080ac00ebd2c937db80d93324226b3fbb9dda607619f44d94dd4c09a8ba0fc The package ing-feat-auth-idin was found to contain malicious code. Source: ghsa-malware...
MAL-2025-192712 Malicious code in auth-handler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79d1be042f1565157d9c5e97b927919aa32bedb254b501aa374caf00c242ee83 The package auth-handler was found to contain malicious code...
EUVD-2025-204941
Malicious code in auth-handler npm...
Malicious code in auth-handler (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 79d1be042f1565157d9c5e97b927919aa32bedb254b501aa374caf00c242ee83 The package auth-handler was found to contain malicious code...
CVE-2025-14964
A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument loginAuthUrl leads to stack-based buffer overflow. The attack may be performed from remote...
CVE-2025-14964
A vulnerability has been found in TOTOLINK T10 4.1.8cu.5083B20200521. This affects the function sprintf of the file /cgi-bin/cstecgi.cgi. Such manipulation of the argument loginAuthUrl leads to stack-based buffer overflow. The attack may be performed from remote...
Security update for salt
This update for salt fixes the following issues: Security issues fixed: CVE-2025-62349: Added minimumauthversion to enforce security bsc1254257 CVE-2025-62348: Fixed Junos module yaml loader bsc1254256 Backport security fixes for vendored tornado BDSA-2024-3438 BDSA-2024-3439 BDSA-2024-9026 Other...
libceph: prevent potential out-of-bounds writes in handle_auth_session_key()
...
Security update 5.1.1.1 for Multi-Linux Manager Client Tools
This update fixes the following issues: grafana was updated from version 11.5.7 to 11.5.10: Security issues fixed: CVE-2025-64751: Drop experimental implementation of authorization Zanzana server/client version 11.5.10 bsc1254113 CVE-2025-47911: Fix parsing HTML documents version 11.5.10 bsc12514...
Server-side Request Forgery (SSRF)
Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the apiURL parameter in authData used by the Instagram OAuth adapter. An attacker can...