UBUNTU-CVE-2025-46712

Erlang/OTP is a set of libraries for the Erlang programming language. In versions prior to OTP-27.3.4 for OTP-27, OTP-26.2.5.12 for OTP-26, and OTP-25.3.2.21 for OTP-25, Erlang/OTP SSH fails to enforce strict KEX handshake hardening measures by allowing optional messages to be exchanged. This...

CVE-2025-27288

CVE-2025-27288 : WordPress WordPress File Icons plugin (versions n/a–2.1) is affected by a Reflected XSS due to improper input neutralization during page generation. CVSS v3.1 base score 7.1 (HIGH); vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L. Affected product: File Icons plugin for Word...

CVE-2025-26260

Plenti = 0.7.16 is vulnerable to code execution. Users uploading '.svelte' files with the /postLocal endpoint can define the file name as javascript codes. The server executes the uploaded file name in host, and cause code execution...

Linux Distros Unpatched Vulnerability : CVE-2023-29403

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - On Unix platforms, the Go runtime does not behave differently when a binary is run with the setuid/setgid bits. This can be dangerous in certain cases, such as...

Linux Distros Unpatched Vulnerability : CVE-2024-45620

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in the pkcs15-init tool in OpenSC. An attacker could use a crafted USB Device or Smart Card, which would present the system with a...

CVE-2024-9911

A vulnerability was found in D-Link DIR-619L B1 2.06. It has been classified as critical. This affects the function formSetPortTr of the file /goform/formSetPortTr. The manipulation of the argument curTime leads to buffer overflow. It is possible to initiate the attack remotely. The exploit has...

PDF-XChange Editor JB2 File Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of PDF-XChange Editor. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Drupal 安全漏洞

Drupal is an open source content management system developed in the PHP language by the Drupal community. A security vulnerability exists in Drupal Swift Mailer, which stems from the inclusion of an Expose Danger method or feature vulnerability...

CVE-2024-56359 Cross-site Scripting vulnerability through HyperLink cells in grist-core

grist-core is a spreadsheet hosting server. A user visiting a malicious document and clicking on a link in a HyperLink cell using a control modifier meaning for example Ctrl+click could have their account compromised, since the link could use the javascript: scheme and be evaluated in the context...

CVE-2024-50525

Unrestricted Upload of File with Dangerous Type vulnerability in helloprint Helloprint helloprint allows Upload a Web Shell to a Web Server.This issue affects Helloprint: from n/a through = 2.0.4...

MAL-2024-8102 Malicious code in @diotoborg/accusamus-itaque-adipisci (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44d00f0d5c1fc24a3aa81b8aa69ab05e19a0aef0cfe9466f97f8c313cb48245c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in danger-ios-logs (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6852 Malicious code in danger-ios-logs (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in Danger.ScriptExec-Vulnerable (NuGet)

--- -= Per source details. Do not edit below this line.=-...

The Breach of a Face Recognition Firm Reveals a Hidden Danger of Biometrics

Outabox, an Australian firm that scanned faces for bars and clubs, suffered a breach that shows the problems with giving companies your biometric data...

Attacks, Vulnerabilities and Actors 19 to 25 February 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, a total of fifteen attacks were executed, five vulnerabilities were uncovered, and five active adversaries...

Attacks, Vulnerabilities and Actors 5 to 11 February 2024

For a detailed threat digest, download the pdf file here Summary HiveForce Labs recently made several significant discoveries in the realm of cybersecurity threats. In the past week alone, a total of five attacks were executed, six vulnerabilities were uncovered, and two active adversaries were...

[H1] Custom upgrade functionality is dangerous

Lines of code Vulnerability details Impact ​ Unsafe upgrade can break protocol Analysis of the vulnerability You are using a custom upgrade for the tokenomics contract not following UUPS standard function changeTokenomicsImplementationaddress implementation external // Check for the contract...

Hub: insecure galaxy-importer tarfile extraction

A path traversal vulnerability exists in Ansible when extracting tarballs. An attacker could craft a malicious tarball so that when using the galaxy importer of Ansible Automation Hub, a symlink could be dropped on the disk, resulting in files being overwritten...

The vulnerability of the Mozilla Firefox browser’s permission request window allows a hacker to perform a spoofing attack.

The vulnerability of the Mozilla Firefox browser’s permission request window is related to insufficient warnings about dangerous actions. Exploiting this vulnerability allows a remote attacker to perform a spoofing attack...