sys/audit Component Code Execution

The vulnerability of the sys/audit component in the Vault Enterprise and Vault Community Edition enterprise information archiving platforms is related to improper code generation management. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to...

AI wrote my code and all I got was this broken prototype

Welcome to this week's edition of the Threat Source newsletter. Vulnerabilities within software are a persistent challenge. Software engineers inadvertently tend to make the same mistakes repeatedly, with the same entries appearing in the annual top 25 list of Common Weakness Enumerations each...

Mozilla Firefox Thunderbird Data Compromise

The vulnerabilities of Mozilla Firefox, Firefox ESR, and the email client Thunderbird are related to improper code generation. Exploiting these vulnerabilities allows a malicious actor to compromise the confidentiality and integrity of protected information...

Dassault Systèmes DELMIA Apriso 安全漏洞

Dassault Systèmes DELMIA Apriso is an interactive manufacturing application for digital enterprises from Dassault Systèmes France. A security vulnerability exists in Dassault Systèmes DELMIA Apriso versions 2020 through 2025 that stems from improper code generation controls and could lead to the...

PurpCode: Reasoning for Safer Code Generation

We introduce PurpCode, the first post-training recipe for training safe code reasoning models towards generating secure code and defending against malicious cyberactivities. PurpCode trains a reasoning model in two stages: i Rule Learning, which explicitly teaches the model to reference cybersafe...

SAMSUNG MagicINFO 9 Server Code Injection Vulnerability

SAMSUNG MagicINFO 9 Server is an enterprise-class digital signage content management and device monitoring platform from Samsung Korea. SAMSUNG MagicINFO 9 Server suffers from a code injection vulnerability that originates from improper code generation control and can be exploited by an attacker ...

CVE-2025-54451

Improper Control of Generation of Code 'Code Injection' vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0...

CVE-2025-54451

Improper Control of Generation of Code 'Code Injection' vulnerability in Samsung Electronics MagicINFO 9 Server allows Code Injection.This issue affects MagicINFO 9 Server: less than 21.1080.0...

SAMSUNG MagicINFO 9 Server 安全漏洞

SAMSUNG MagicINFO 9 Server is an enterprise-class digital signage content management and device monitoring platform from Samsung Korea. SAMSUNG MagicINFO 9 Server suffers from a code injection vulnerability that originates from improper code generation control and can be exploited by an attacker ...

Critical SharePoint Vulnerabilities Under Active Exploitation

Critical SharePoint Vulnerabilities Under Active Exploitation By Jeffrey Sman, Mo Cashman and Marc Bolz Robinson · July 23, 2025 On-premises Microsoft SharePoint servers are currently facing high-impact, ongoing threat activity due to a set of critical vulnerabilities, notably CVE-2025-49704,...

Microsoft SharePoint Remote Code Execution Vulnerability

SharePoint Server is a locally deployed enterprise collaboration platform from Microsoft that supports content sharing, knowledge management, and application integration, and works seamlessly with Microsoft 365 subscriptions to access the latest features. A remote code execution vulnerability...

PT-2025-43307

Name of the Vulnerable Software and Affected Versions Bearsthemes Alone versions through 7.8.3 Description A code injection issue exists in Bearsthemes Alone. The issue involves improper control of code generation. This could allow for code injection. Recommendations Update Bearsthemes Alone to a...

Microsoft SharePoint Code Execution

The vulnerability of the Microsoft SharePoint software package is related to improper code generation management. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

A Mixture of Linear Corrections Generates Secure Code

Large language models LLMs have become proficient at sophisticated code-generation tasks, yet remain ineffective at reliably detecting or avoiding code vulnerabilities. Does this deficiency stem from insufficient learning about code vulnerabilities, or is it merely a result of ineffective...

Azure Monitor Agents Code Execution

Vulnerability of the data collection tool for Azure Monitor Agent, which processes virtual machines and physical servers, due to improper code generation management. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

SUSE CVE-2025-38339

In the Linux kernel, the following vulnerability has been resolved: powerpc/bpf: fix JIT code size calculation of bpf trampoline archbpftrampolinesize provides JIT size of the BPF trampoline before the buffer for JIT'ing it is allocated. The total number of instructions emitted for BPF trampoline...

OpenText Directory Services 代码注入漏洞

OpenText Directory Services OTDS is an information management solution from OpenText Canada Inc. integrating OpenText products and solutions with the company's enterprise directory infrastructure. A code injection vulnerability exists in OpenText Directory Services version 23.4 that stems from...

RTS VLink Virtual Matrix Software Code Execution

The vulnerability of the RTS VLink Virtual Matrix software for intercom systems and the Telex Remote Dispatch Console software for IP dispatcher systems is related to improper code generation. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

SAP S/4HANA Characteristic Propagation Code Generation Management RCE

The vulnerability of the SAP S/4HANA resource planning system and the SAP SCM supply chain management software’s “Characteristic Propagation” function is related to improper code generation. Exploiting this vulnerability allows a malicious actor to generate arbitrary code and gain unauthorized...

PT-2025-54561

Уязвимость почтового клиента Blue Mail связана с неверным управлением генерацией кода. Эксплуатация уязвимости может позволить нарушителю, действующему удалённо, выполнить произвольный код...