CVE-2024-40590

An improper certificate validation vulnerability CWE-295 in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and below when connecting to a FortiManager device, a FortiAnalyzer device, or an SMTP server may allow an unauthenticated attacker in a...

CVE-2024-40590

CVE-2024-40590 describes an improper certificate validation (CWE-295) in FortiPortal. Affected are FortiPortal versions 7.4.0, 7.2.4 and below, 7.0.8 and below, and 6.0.15 and below when connecting to a FortiManager device, FortiAnalyzer device, or an SMTP server. This allows an unauthenticated a...

GSMA Confirms End-to-End Encryption for RCS, Enabling Secure Cross-Platform Messaging

The GSM Association GSMA has formally announced support for end-to-end encryption E2EE for securing messages sent via the Rich Communications Services RCS protocol, bringing much-needed security protections to cross-platform messages shared between Android and iOS platforms. To that end, the new...

Malicious code in oasis-os-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0855cc5a073138729aaaff78692f8f6b631c4466abbd62dc4a8d7407b86ea5e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2346 Malicious code in oasis-os-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0855cc5a073138729aaaff78692f8f6b631c4466abbd62dc4a8d7407b86ea5e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-27594

The device uses an unencrypted, proprietary protocol for communication. Through this protocol, configuration data is transmitted and device authentication is performed. An attacker can thereby intercept the authentication hash and use it to log into the device using a pass-the-hash attack...

CVE-2025-27594

The CVE-2025-27594 entry concerns the SICK DL100-2xxxxxxx series where a proprietary protocol transmits configuration data and authenticates devices without encryption. The underlying issue is the unencrypted protocol, which can allow an attacker to intercept the authentication hash and perform a...

NFC: nci: Add bounds checking in nci_hci_create_pipe()

...

Malicious code in messaging-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9fec082e41ee10acbec950c120b5c9c4a3184fbe0ce6995a3da0356c826601e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @contraktor-tech/poc_confusion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9fb8ec2fd9c3fd1eb30ca17367b62f932aa239c8b9209269913e9c88ea105536 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in notification-center-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3608296b1021343f3245e75793f59483ee9c78f0aa41ca662756286d02d348a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Command Execution Vulnerability in the Management Panel of Car Park Server of Xiamen KTO Communication Technology Co.

Xiamen KTO Communication Technology Co., Ltd. is a professional smart parking solution provider, focusing on the smart parking industry for many years. A command execution vulnerability exists in the management panel of the car park server of Xiamen KTO Communication Technology Co. Ltd, which can...

Deserialization of Untrusted Data

Overview github.com/cosmos/ibc-go/v10/modules/core/04-channel/keeper is an interblockchain communication protocol IBC implementation in Golang built as a SDK module. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to inconsistencies in the deserialization...

Malicious code in hybrid-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eac5872f7c58c6dc0aa16876689ec20891753358c36a7a1c35c223e3d3f9cf38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-2218 LoveCards LoveCardsV2 Setting other access control

A vulnerability has been found in LoveCards LoveCardsV2 up to 2.3.2 and classified as critical. This vulnerability affects unknown code of the file /api/system/other of the component Setting Handler. The manipulation leads to improper access controls. The attack can be initiated remotely. The...

MAL-2025-2288 Malicious code in customer-identity-mfe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b4077d7dbb9f3ee9d04701dde8555a12f1b9437942c6e70540060d16e0288435 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pixelary (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed6e04cfdf17df0b3303f51acdf9e0e128361f17eef5fa028f6bd70d3436984c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in limit-order-validation (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a7ad6cba9faf323fb0ffae19f703ba40944f39673b2e8803037d19ff0990671f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-0071

SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impac...

CVE-2025-0071 Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager

SAP Web Dispatcher and Internet Communication Manager allow an attacker with administrative privileges to enable debugging trace mode with a specific parameter value. This exposes unencrypted passwords in the logs, causing a high impact on the confidentiality of the application. There is no impac...