CISA Releases Fact Sheet Detailing Embedded Backdoor Function of Contec CMS8000 Firmware

CISA released a fact sheet, Contec CMS8000 Contains a Backdoor, detailing an analysis of three firmware package versions of the Contec CMS8000, a patient monitor used by the U.S. Healthcare and Public Health HPH sector. Analysts discovered that an embedded backdoor function with a hard-coded IP...

CVE-2025-24357

vLLM is a library for LLM inference and serving. vllm/modelexecutor/weightutils.py implements hfmodelweightsiterator to load the model checkpoint, which is downloaded from huggingface. It uses the torch.load function and the weightsonly parameter defaults to False. When torch.load loads malicious...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to bypass security restriction due to Node.js undici module ( CVE-2024-30261, CVE-2024-30260 )

Summary Node.js undici module is used by IBM Cloud Pak for Data as part of the platform. CVE-2024-30261, CVE-2024-30260. Vulnerability Details CVEID:CVE-2024-30261 DESCRIPTION: Node.js undici module could allow a remote authenticated attacker to bypass security restrictions, caused by a flaw with...

Dell Data Lakehouse 安全漏洞

Dell Data Lakehouse is a fully integrated data platform from Dell, Inc. An encryption issue vulnerability exists in Dell Data Lakehouse version 1.0.0.0, which stems from a missing encryption of sensitive data contained in the DDAE. An attacker could exploit this vulnerability to cause information...

CVE-2023-0487 My Sticky Elements < 2.0.9 - Admin+ SQLi

The My Sticky Elements WordPress plugin before 2.0.9 does not properly sanitise and escape a parameter before using it in a SQL statement when deleting messages, leading to a SQL injection exploitable by high privilege users such as admin...

Oracle Hospitality Reporting and Analytics 安全漏洞

Oracle Hospitality Reporting and Analytics is an Oracle platform for hotels that generates reports for analyzing operational data. Oracle Hospitality Reporting and Analytics has a security vulnerability that can be exploited by an attacker to cause unauthorized creation, deletion, or modification...

PT-2023-15954 · Sap · Sap Bank Account Management

Name of the Vulnerable Software and Affected Versions: SAP Bank Account Management Manage Banks affected versions not specified Description: The issue concerns the disclosure of sensitive data in the SAP Bank Account Management Manage Banks application. When a user clicks a smart link to navigate...

PT-2022-26314 · Unknown · Open Source Sacco Management System

Name of the Vulnerable Software and Affected Versions: Open Source SACCO Management System version 1.0 Description: The issue concerns SQL Injection via the "/sacco shield/manage loan.php" API endpoint. This allows for potential unauthorized access and manipulation of data. No information is...

Oracle PeopleSoft Enterprise SCM eProcurement 输入验证错误漏洞

Oracle PeopleSoft Enterprise SCM eProcurement is an application from Oracle America, Inc. used for temporary user request items.Oracle PeopleSoft Enterprise SCM eProcurement is vulnerable to an input validation error that could be exploited by an attacker to update, insert, or delete accessible...

TYPO3 cross-site scripting vulnerability (CNVD-2021-26150)

TYPO3 is a free and open source content management system framework CMS/CMF of the Swiss TYPO3 Typo3 Association. TYPO3 suffers from a cross-site scripting vulnerability that originates from insufficient processing of user-supplied data in the system extension Fluid typo3 / cms-fluid when...

CVE-2012-5639

LibreOffice and OpenOffice automatically open embedded content...

puerto-de-santa-maria-el-1.listado-empresas.es Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-979623 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

CVE-2018-8566

creationtimestamp| type| source ---|---|--- 2018-11-14 17:39:01+00:00| seen| MISP/5bec5b59-b2b0-4506-9c63-32a40a021402...

CVE-2018-10583

creationtimestamp| type| source ---|---|--- 2018-06-06 16:36:03+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/fileformat/odtbadodt.rb 2025-02-06 03:13:43+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:10:02+00:00| seen|...

CVE-2014-5073

creationtimestamp| type| source ---|---|--- 2018-05-29 15:50:33+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/unix/http/vmturbovmtadminexecnoauth.rb 2025-02-06 03:13:41+00:00| seen| MISP/a1e796df-2ad8-4c8d-8b69-737a004e72dd 2025-02-23 04:09:30+00:00| see...

The vulnerability of the Microsoft .NET Framework software platform, which allows a perpetrator to gain access to protected information

The vulnerability of the Microsoft .NET Framework software platform is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to protected information by using data in open text format within the client-server da...

CVE-2012-1723

Unspecified vulnerability in the Java Runtime Environment JRE component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.237 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to...

Kingdee K3 emergence of serious security vulnerabilities, a hacker can easily read the database all the information-vulnerability warning-the black bar safety net

From the pixel buns Estimated other ERP Software also a lot of similar things, interested students can talk to about it. Reproduced start. This flaw in the K3 of each version are present and the same, including the new version of the K3 V12. 3 version. Major data security vulnerability is describ...