EUVD-2016-10799

JVC VN-T IP-camera models firmware versions up to 2016-08-22 confirmed on the VN-T216VPRU model contain a directory traversal vulnerability in the checkcgi endpoint that accepts a user-controlled file parameter. An unauthenticated remote attacker can leverage this vulnerability to read arbitrary...

Siemens SIMATIC S7-1500 Inefficient Algorithmic Complexity (CVE-2022-45061)

An issue was discovered in Python before 3.11.1. An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA RFC 3490 decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service. Hostnames are often...

CVE-2016-15055

JVC VN-T IP-camera models firmware versions up to 2016-08-22 confirmed on the VN-T216VPRU model contain a directory traversal vulnerability in the checkcgi endpoint that accepts a user-controlled file parameter. An unauthenticated remote attacker can leverage this vulnerability to read arbitrary...

python-kdcproxy: Remote DoS via unbounded TCP upstream buffering

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server e.g. through server-side request forgery, they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copie...

CVE-2025-59089

CVE-2025-59089 is a DoS in python-kdcproxy caused by unbounded TCP buffering and permissive handling of response chunks, enabling memory/CPU exhaustion when kdcproxy connects to attacker-controlled KDCs. Related issue CVE-2025-59088 concerns SSRF via DNS SRV discovery for realms, allowing probing...

CVE-2025-59089

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server e.g. through server-side request forgery, they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copie...

python-kdcproxy: Remote DoS via unbounded TCP upstream buffering

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server e.g. through server-side request forgery, they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copie...

EUVD-2025-105996

Malicious code in controlledhaddockz3n npm...

EUVD-2025-77238

Malicious code in controlledamphibian-gooddev npm...

EUVD-2025-79531

Malicious code in controlledhedgehogz3n npm...

EUVD-2025-64772

Malicious code in controlledbeetlez3n npm...

EUVD-2025-64771

Malicious code in controlledmoosez3n npm...

EUVD-2025-55186

Malicious code in controlled-green-crab npm...

EUVD-2025-55187

Malicious code in controlled-chocolate-seahorse npm...

MAL-2025-67463 Malicious code in controlled-green-crab (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 85f3075d4b1b291d4dc8e40aaa85da5687cff4a209b910da38f9630cb5b19bc8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

SUSE CVE-2025-64436

KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could...

CVE-2025-64182

OpenEXR provides the specification and reference implementation of the EXR file format, an image storage format for the motion picture industry. In versions 3.2.0 through 3.2.4, 3.3.0 through 3.3.5, and 3.4.0 through 3.4.2, a memory safety bug in the legacy OpenEXR Python adapter the deprecated...

CVE-2025-60876

BusyBox wget thru 1.3.7 accepted raw CR 0x0D/LF 0x0A and other C0 control bytes in the HTTP request-target path/query, allowing the request line to be split and attacker-controlled headers to be injected. To preserve the HTTP/1.1 request-line shape METHOD SP request-target SP HTTP/1.1, a raw spac...

EUVD-2025-50490

Malicious code in controlledstoatz3n npm...

Malicious code in controlled_landfowl_z3n (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 429538585f09d0e939515f41598eab7729dffce3c7d55849dcf2d7b2f45dc58c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...