7315 matches found
Authorization Bypass Through User-Controlled Key
Overview moodle/moodle is a learning platform. Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to insufficient capability checks in the RSS block. An attacker can access and view additional RSS feeds by exploiting the IDOR vulnerability...
Developing a Blockchain-Based Secure Digital Contents Distribution System
As digital content distribution expands rapidly through online platforms, securing digital media and protecting intellectual property has become increasingly complex. Traditional centralized systems, while widely adopted, suffer from vulnerabilities such as single points of failure and limited...
MAL-2025-3542 Malicious code in concurrent-hashmap (npm)
This package runs a post-install script that exfils sensitive data to a attacker-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b043630941c12131f7d10fdb97608a15c397c2cf21e74116aa2fd89a1840a58e Any computer that has this package installed or runni...
Exploit for Exposure of Sensitive Information to an Unauthorized Actor in Microsoft
Video Tutorial !CVE-2025-24071 Demohttps://img.youtube.co...
MAL-2025-3543 Malicious code in slf4j-api-js (npm)
This package runs a post-install script that exfils sensitive data to a attacker-controlled server. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3bf0cf1724507eaf1d28ec976793772cc682047cc52a74438224fb96d61884b Any computer that has this package installed or runni...
Sonos api.sonos.com 安全漏洞
Sonos api.sonos.com is an interface service from Sonos, Inc. A security vulnerability exists in Sonos api.sonos.com version 2025-04-21 and earlier, which originates in the /login/v3/oauth endpoint that accepts a redirecturi containing user information, which could result in an authorization code...
SUSE CVE-2017-9333
OpenWebif 1.2.5 allows remote code execution via a URL to the CallOPKG function in the IpkgController class in plugin/controllers/ipkg.py, when the URL refers to an attacker-controlled web site with a Trojan horse package. This has security implications in cases where untrusted users can trigger...
Q-FAKER: Query-Free Hard Black-Box Attack Via Controlled Generation
Many adversarial attack approaches are proposed to verify the vulnerability of language models. However, they require numerous queries and the information on the target model. Even black-box attack methods also require the target model's output information. They are not applicable in real-world...
Clickjacking
tarteaucitronjs is vulnerable to clickjacking. The vulnerability is due to improper validation of user-controlled CSS inputs for element dimensions, allowing attackers to overlay the viewport with malicious elements...
CVE-2025-27561 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename "rooms" of arbitrary users...
CVE-2025-27561 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can rename "rooms" of arbitrary users...
CVE-2025-30257
CVE-2025-30257 relates to Growatt Cloud portal authorization bypass through a user-controlled key. The included connected records confirm that unauthenticated attackers can retrieve the serial number of smart meters associated with a specific user account, indicating an information disclosure vul...
CVE-2025-30257 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can retrieve serial number of smart meters associated to a specific user account...
CVE-2025-31360
CVE-2025-31360 affects Growatt Cloud Applications (Growatt Cloud Portal). Multiple connected sources confirm an unauthenticated attacker can trigger device actions associated with specific “scenes” of arbitrary users, implying remote control of devices without user interaction. The vulnerability ...
CVE-2025-31360 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...
CVE-2025-31360 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
Unauthenticated attackers can trigger device actions associated with specific "scenes" of arbitrary users...
CVE-2025-24850 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can export other users' plant information...
CVE-2025-24850 Growatt Cloud portal Authorization Bypass Through User-Controlled Key
An attacker can export other users' plant information...
CVE-2025-25276
CVE-2025-25276 relates to Growatt Cloud Applications (Growatt Cloud portal). Connected documents confirm an unauthenticated attacker can hijack other users’ devices and potentially take control, via vulnerabilities including an authorization bypass through a user-controlled key and improper input...