Malicious code in 3cx-call-control-apps (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca09aeb5dd1513eb46048a6987f18b72f8c9f52ba8340cefc8521c2138be8503 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

iperf: Denial of Service in iperf Due to Improper JSON Handling

A flaw was found in iperf. This vulnerability allows a Denial of Service DoS via the injection of malformed JSON data, which can result in a segmentation fault when a NULL pointer is passed to strdup...

CVE-2024-57917 topology: Keep the cpumask unchanged when printing cpumap

In the Linux kernel, the following vulnerability has been resolved: topology: Keep the cpumask unchanged when printing cpumap During fuzz testing, the following warning was discovered: different return values 15 and 11 from vsnprintf"%pbl ", ... test:keyward is WARNING in kvasprintf WARNING: CPU:...

PT-2025-13358 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: The issue is related to the thermal core in the Linux kernel, where put device is called before device register fails. The function thermal cooling device register does not follow this...

BIT-PYTHON-MIN-2023-6507 Groups not dropped before running subprocess when using empty 'extra_groups' parameter

An issue was found in CPython 3.12.0 subprocess module on POSIX platforms. The issue was fixed in CPython 3.12.1 and does not affect other stable releases. When using the extragroups= parameter with an empty list as a value ie extragroups= the logic regressed to not call setgroups0, NULL before...

CVE-2025-23745

Cross-Site Request Forgery CSRF vulnerability in Tussendoor B.V. Call me Now call-me-now allows Stored XSS.This issue affects Call me Now: from n/a through = 1.0.5...

CVE-2025-23745 WordPress Call me Now plugin <= 1.0.5 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in Tussendoor B.V. Call me Now call-me-now allows Stored XSS.This issue affects Call me Now: from n/a through = 1.0.5...

CVE-2025-23745

CVE-2025-23745 describes a CSRF vulnerability in the WordPress plugin “Call me Now” that can trigger a Stored XSS. The description states affected versions are from n/a up to 1.0.5. Connected Red Hat advisory RH:CVE-2025-23745 repeats this fault, confirming the issue location as Call me Now. The ...

WordPress Podamibe Twilio Private Call plugin <= 1.0.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin Podamibe Twilio Private Call versions = 1.0.1...

WordPress Call me Now plugin <= 1.0.5 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO in WordPress Plugin Call me Now versions = 1.0.5...

WordPress Call To Action Popup plugin <= 1.0.2 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by Le Ngoc Anh in WordPress Plugin Call To Action Popup versions = 1.0.2...

WordPress plugin Call me Now 跨站请求伪造漏洞

WordPress and the WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2025-5061 · Unknown · Call Me Now

Name of the Vulnerable Software and Affected Versions: Call me Now versions n/a through 1.0.5 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web application, and also...

CVE-2024-57894

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2024-57795

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Remove the direct link to netdevice The similar patch in siw is in the link: https://git.kernel.org/rdma/rdma/c/16b87037b48889 This problem also occurred in RXE. The following analyze this problem. In the following Call...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from an issue in the mm/kmemleak component that calls a sleep function from an invalid environment...

CVE-2025-0068 Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availability on the application...

CVE-2025-0068

CVE-2025-0068 is an information-disclosure vulnerability in SAP NetWeaver Application Server ABAP. The root cause is a missing authorization check in remote function calls (RFC), enabling an authenticated attacker to access restricted information. The impact is limited to confidentiality (no inte...

CVE-2025-0067

CVE-2025-0067 relates to SAP NetWeaver Application Server Java where a missing authorization check on service endpoints lets a user with a standard role create JCo connections used for remote function calls. The impact is described as low for confidentiality, integrity, and availability. Affected...

Vyper 安全漏洞

Vyper is a Pythonic smart contract language for EVM open sourced by vyperlang. A security vulnerability exists in Vyper 0.4.0 and earlier versions, which stems from the compiler failing to check the success flag of a call when using pre-compiled EcRecover and Identity, which could lead to incorre...