MAL-2025-1277 Malicious code in probit-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b53f56d9feb1821fb971f6e193dc7ea5df777a9e0136fa3068e4775f197e0e23 Any computer that has this package install...

MAL-2025-1280 Malicious code in probit-test (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8db186f44c4cce05bf17f2684794f1def34c2db3c28e7b4eb69347459ddb4c76 Any computer that has this package install...

MAL-2025-1279 Malicious code in probit-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b90c84ef211f2f9ce83ee001f131dc0beaf0a6c6bf8667374fb9f14e54ae6fe3 Any computer that has this package install...

MAL-2025-1274 Malicious code in toobit-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbef733acdf5215bfdef9bb31af40ec7e1bd2fb0cab3167cf10876e9020e971e Any computer that has this package install...

MAL-2025-1272 Malicious code in toobit-dev (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5d0f3cbca32c205dc8a61718610eba04f690441add92e4fb0e98f1e3f18f21f9 Any computer that has this package install...

MAL-2025-1275 Malicious code in toobit-test (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c55608bc5157f14f615aea6e2e8fd8a5004e3a307d5a12e69f5f6d311d2a74c9 Any computer that has this package install...

Malicious code in toobit-test (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c55608bc5157f14f615aea6e2e8fd8a5004e3a307d5a12e69f5f6d311d2a74c9 Any computer that has this package install...

CVE-2023-40721

A use of externally-controlled format string vulnerability CWE-134 vulnerability in Fortinet allows a privileged attacker to execute arbitrary code or commands via specially crafted requests...

Path Traversal

github.com/clidey/whodb/core is vulnerable to Path Traversal. The vulnerability is due to improper path validation due to the lack of checks when joining user-controlled database file names with the default directory, allowing an attacker to use path traversal ../../ to access any Sqlite3 databas...

CVE-2025-23363

Summary (CVE-2025-23363): Siemens Teamcenter V14.x products disclose an open-redirect issue in the SSO login service. The SSO accepts user-controlled input that can specify an external URL, enabling an attacker to lure a legitimate user into clicking a crafted link that redirects to a malicious s...

Azure Linux 3.0 Security Update: rsync (CVE-2024-12084)

The version of rsync installed on the remote Azure Linux 3.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-12084 advisory. - A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of...

CVE-2025-22695

Authorization Bypass Through User-Controlled Key vulnerability in NirWp Team Nirweb support nirweb-support.This issue affects Nirweb support: from n/a through = 3.0.3...

WhoDB has a path traversal opening Sqlite3 database

Summary While the application only displays Sqlite3 databases present in the directory /db, there is no path traversal prevention in place. This allows an unauthenticated attacker to open any Sqlite3 database present on the host machine that the application is running on. Details WhoDB allows use...

CVE-2022-4799

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1...

CVE-2022-4686

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.0...

CVE-2022-4798

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1...

CVE-2022-4505

Authorization Bypass Through User-Controlled Key in GitHub repository openemr/openemr prior to 7.0.0.2...

CVE-2022-4802

Authorization Bypass Through User-Controlled Key in GitHub repository usememos/memos prior to 0.9.1...

CVE-2022-4811

Authorization Bypass Through User-Controlled Key vulnerability in usememos usememos/memos.This issue affects usememos/memos before 0.9.1...

CVE-2022-48598

A SQL injection vulnerability exists in the “reporter events type date” feature of the ScienceLogic SL1 that takes unsanitized user‐controlled input and passes it directly to a SQL query. This allows for the injection of arbitrary SQL before being executed against the database...