yudao-cloud 安全漏洞

yudao-cloud is a backend management system for YunaiV individual developers. A security vulnerability exists in yudao-cloud version 2025.09 and earlier, which stems from incorrect manipulation of the parameter ids/newOwnerUserId in the file /crm/business/transfer, which could lead to improper...

CVE-2023-7042 vulnerabilities

Vulnerabilities for packages: linux-aws, linux-qemu, linux-azure, linux-gcp-generic, linux-gcp, linux-azure-generic, linux-vmware, linux-vmware-generic, linux-qemu-generic, linux-qemu-rc, linux-aws-generic...

Malicious code in @google_cloud/projectify (npm)

The package @googlecloud/projectify was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 348dd9384a1e11bd9559bcdb3d4e2ef98ad16da2967df02ad4b6764b8d9ef2af Any computer that has this package installed or running should be considered ful...

Malicious Package

Overview @googlecloud/precise-date is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...

MAL-2025-47029 Malicious code in @google_cloud/precise-date (npm)

The package @googlecloud/precise-date was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fe210b8cac7607562aceba7accb395f7d72480112abadec2545c8863f9029ac Any computer that has this package installed or running should be considered...

Malicious code in @google_cloud/precise-date (npm)

The package @googlecloud/precise-date was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8fe210b8cac7607562aceba7accb395f7d72480112abadec2545c8863f9029ac Any computer that has this package installed or running should be considered...

MAL-2025-47030 Malicious code in @google_cloud/projectify (npm)

The package @googlecloud/projectify was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 348dd9384a1e11bd9559bcdb3d4e2ef98ad16da2967df02ad4b6764b8d9ef2af Any computer that has this package installed or running should be considered ful...

Malicious Package

Overview @googlecloud/common is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview @googlecloud/projectify is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...

ROS-20250911-11

A vulnerability in Cloud-init cloud server configuration tool is related to incorrect assignment of permissions for a critical resource. Exploitation of the vulnerability could allow an attacker to execute arbitrary commands A vulnerability in the Cloud-Init cloud virtual machine provisioning too...

Branch Predictor Isolation in KVM-QEMU

Summary Researchers claim new KVM-QEMU primitives allow exploitation of Spectre V2 resulting in information leakage in various cloud scenarios. KVM-QEMU is a combination of KVM Kernel-based Virtual Machine, a Linux kernel module that enables hardware-assisted virtualization and Quick Emulator QEM...

CVE-2025-59049 Mockoon has a Path Traversal and LFI in the static file serving endpoint

Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal...

Akira Ransomware Group Utilizing SonicWall Devices for Initial Access

Latest update – September 18, 2025 On September 17, 2025, SonicWall disclosed a security breach affecting all SonicWall customers with MySonicWall.com cloud backups enabled. The firm detected suspicious activity targeting MySonicWall.com, through which threat actors were able to access backup...

CVE-2025-36759

Through the provision of user names, SolaX Cloud will suggest similar user accounts and thereby leak sensitive information such as user email addresses and phone numbers...

CVE-2025-36757

It is possible to bypass the administrator login screen on SolaX Cloud. An attacker could use parameter tampering to bypass the login screen and gain limited access to the system...

CVE-2025-36758

It is possible to bypass the clipping level of authentication attempts in SolaX Cloud through the use of the 'Forgot Password' functionality as an oracle...

CVE-2025-36756

A problem with missing authorization on SolaX Cloud platform allows taking over any SolaX solarpanel inverter of which the serial number is known...

CVE-2025-36759 Sensitive Information Disclosure in SolaX Cloud

Through the provision of user names, SolaX Cloud will suggest similar user accounts and thereby leak sensitive information such as user email addresses and phone numbers...

CVE-2025-36759 Sensitive Information Disclosure in SolaX Cloud

Through the provision of user names, SolaX Cloud will suggest similar user accounts and thereby leak sensitive information such as user email addresses and phone numbers...

CVE-2025-36759

CVE-2025-36759 affects SolaX Cloud. The vulnerability stems from the username-suggestion feature that can reveal other users’ emails and phone numbers. Impact is information disclosure of user contact data (confidentiality HIGH). Connected sources confirm SolaX Cloud and the leakage via similar a...