CVE-2025-20379

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using th...

CVE-2025-20379 Risky command safeguards bypass using the “/services/streams/search“ REST endpoint through “q“ parameter in Splunk Enterprise

In Splunk Enterprise versions below 10.0.1, 9.4.5, 9.3.7, and 9.2.9 and Splunk Cloud Platform versions below 9.3.2411.116, 9.3.2408.124, 10.0.2503.5 and 10.1.2507.1, a low-privileged user that does not hold the “admin“ or “power“ Splunk roles could run a saved search with a risky command using th...

CVE-2025-40171

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmetfclsreqop It’s possible for more than one async command to be in flight from nvmetfcsendlsreq. For each command, a tgtport reference is taken. In the current code, only one put work item is...

UBUNTU-CVE-2025-40171

In the Linux kernel, the following vulnerability has been resolved: nvmet-fc: move lsop put work to nvmetfclsreqop It’s possible for more than one async command to be in flight from nvmetfcsendlsreq. For each command, a tgtport reference is taken. In the current code, only one put work item is...

CVE-2025-40171

Technical details for CVE-2025-40171 are not provided in the supplied connected documents. Monitor for vendor advisories for affected products, versions, impact, and fixes.

CVE-2025-42894

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

Splunk Cloud Platform和Splunk Enterprise 信息泄露漏洞

Splunk Cloud Platform and Splunk Enterprise are both products of Splunk Corporation, U.S.A. Splunk Cloud Platform is a powerful data collection, processing, and analytics service.Splunk Enterprise is a suite of data collection and analytics software. An information disclosure vulnerability exists...

Linux kernel 安全漏洞

Linux kernel is the kernel used by Linux, the open source operating system of the Linux Foundation in the United States. A security vulnerability exists in the Linux kernel that stems from nvmet-fc not properly handling multiple asynchronous commands, which could lead to a resource leak...

Pack-A-Mal: A Malware Analysis Framework for Open-Source Packages

The increasingly sophisticated environment in which attackers operate makes software security an even greater challenge in open-source projects, where malicious packages are prevalent. Static analysis tools, such as Malcontent, are highly useful but are often incapable of dealing with obfuscated...

Linux Distros Unpatched Vulnerability : CVE-2025-40171

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - nvmet-fc: move lsop put work to nvmetfclsreqop It's possible for more than one async command to be in flight from nvmetfcsendlsreq. For each command, a tgtport...

CVE-2024-32011

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to run arbitrary commands via the user interface. This user interface can be used via the network and allows the execution of commands as administrative application use...

CVE-2024-32010

A vulnerability has been identified in Spectrum Power 4 All versions V4.70 SP12 Update 2. The affected application is vulnerable to extraction of database credentials via a world-readable credential file. This allows an attacker to connect to the database as privileged application user and to run...

Malicious code in warnermedia-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 235c7d43006e41c31c3b06069239c483934cee515a1f489c55e698fdf994909e The OpenSSF Package Analysis project identified 'warnermedia-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in ikea-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2d28e0f1a30aac98cbe4b49221df9736b6cbe4d629d85b5b57d50cc4163f72df The OpenSSF Package Analysis project identified 'ikea-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The package executes...

Malicious code in netflix-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 711ffa8c0ce9379a63de3ef137c0bf569750b0d78159c94ec77e3e25b5354050 The OpenSSF Package Analysis project identified 'netflix-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2025-138578 Malicious code in netflix-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 711ffa8c0ce9379a63de3ef137c0bf569750b0d78159c94ec77e3e25b5354050 The OpenSSF Package Analysis project identified 'netflix-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2025-11697 Studio 5000 ® Simulation Interface Local Code Execution

A local code execution security issue exists within Studio 5000® Simulation Interface™ via the API. This vulnerability allows any Windows user on the system to extract files using path traversal sequences, resulting in execution of scripts with Administrator privileges on system reboot...

EUVD-2025-60985

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

CVE-2025-42894

Due to a Path Traversal vulnerability in SAP Business Connector, an attacker authenticated as an administrator with adjacent access could read, write, overwrite, and delete arbitrary files on the host system. Successful exploitation could enable the attacker to execute arbitrary operating system...

CVE-2025-42892

Due to an OS Command Injection vulnerability in SAP Business Connector, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating...