CVE-2025-6748 Bharti Airtel Thanks App files cleartext storage in a file or on disk

A vulnerability classified as problematic has been found in Bharti Airtel Thanks App 4.105.4 on Android. Affected is an unknown function of the file /Android/data/com.myairtelapp/files/. The manipulation leads to cleartext storage in a file or on disk. It is possible to launch the attack on the...

PT-2025-27040

Name of the Vulnerable Software and Affected Versions: Flock Safety LPR devices versions through 2.2 Description: The issue concerns an on-chip debug interface with improper access control. Recommendations: For versions through 2.2, consider disabling the on-chip debug interface until a patch is...

CVE-2025-47823

Flock Safety LPR License Plate Reader devices with firmware through 2.2 have a hardcoded password for a system...

CVE-2025-47819

CVE-2025-47819 affects Flock Safety Gunshot Detection devices prior to version 1.3. The issue is an on‑chip debug interface with improper access control, enabling potential compromise of confidentiality, integrity, and availability with physical access. The CVE entry lists a base impact of HIGH f...

Siemens SCALANCE, RUGGEDCOM, SIPLUS, and SINEC RADIUS Protocol Forgery Attacks (CVE-2024-3596)

RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify responses Access-Reject or Access-Accept using a chosen-prefix collision attack against MD5 Response Authenticator signature. This plugin only works with Tenable.ot. Please visit...

PT-2025-27041 · Flock Safety · Flock Safety Lpr

Name of the Vulnerable Software and Affected Versions: Flock Safety LPR devices with firmware through 2.2 Description: The issue concerns a hardcoded password for a system in Flock Safety LPR devices. Recommendations: For Flock Safety LPR devices with firmware through 2.2, consider changing the...

D-Link DCS-5020L Buffer Overflow Vulnerability (May 2025)

D-Link DCS-5020L devices are prone to a buffer overflow vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

Malicious code in utils-component (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2915f8670a8badcf10c91c6f4495435134004b4394050fd25077ced85b2176f Any computer that has this package installed or running should be considered...

White House Bans WhatsApp

Reuters is reporting that the White House has banned WhatsApp on all employee devices: The notice said the "Office of Cybersecurity has deemed WhatsApp a high risk to users due to the lack of transparency in how it protects user data, absence of stored data encryption, and potential security risk...

CVE-2025-41427

WRC-X3000GS, WRC-X3000GSA, and WRC-X3000GSN contain an improper neutralization of special elements used in an OS command 'OS Command Injection' vulnerability in Connection Diagnostics page. If a remote authenticated attacker sends a specially crafted request to the affected product, an arbitrary ...

CVE-2025-34033

An OS command injection vulnerability exists in the Blue Angel Software Suite running on embedded Linux devices via the pingaddr parameter in the webctrl.cgi script. The application fails to properly sanitize input before passing it to the system-level ping command. An authenticated attacker can...

Axis Communications End-of-Life Devices Detection

The current plugin identifies Axis devices that are end-of-life, i.e., still supported but have a discontinued date announced. Axis Lifecycle Statuses: - Active: Most current offering within a product category. - End of Life: Discontinued date announced - actively execute migrations and last time...

Axis Communications Active Devices Detection

The current plugin identifies Axis devices that are still under active support. Axis Lifecycle Statuses: - Active: Most current offering within a product category. - End of Life: Discontinued date announced - actively execute migrations and last time buys. Product generally orderable until the...

Axis Communications Discontinued Devices Detection

The current plugin identifies Axis devices that are currently discontinued. Axis Lifecycle Statuses: - Active: Most current offering within a product category. - End of Life: Discontinued date announced - actively execute migrations and last time buys. Product generally orderable until the...

CVE-2025-5834 Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability

Pioneer DMH-WT7600NEX Missing Immutable Root of Trust in Hardware Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to bypass authentication on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this...

Malicious code in secure-r007k17 (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbd04d692c36ca50563b6dbb1de8053730817b3f74b9e23389dd90505621062a Any computer that has this package installed or running should be considered...

CVE-2024-51983

CVE-2024-51983 is an unauthenticated DoS affecting multiple Brother/Brother-related devices (printer/ multifunction). The issue arises from improper validation of input in WS-Scan over Web Services (port 80); sending a WS-Scan SOAP request with an unexpected JobToken value crashes the device and ...

[SECURITY] Fedora 41 Update: udisks2-2.10.1-7.fc41

The Udisks project provides a daemon, tools and libraries to access and manipulate disks, storage devices and technologies...

Client Clustering Meets Knowledge Sharing: Enhancing Privacy and Robustness in Personalized Peer-To-Peer Learning

The growing adoption of Artificial Intelligence AI in Internet of Things IoT ecosystems has intensified the need for personalized learning methods that can operate efficiently and privately across heterogeneous, resource-constrained devices. However, enabling effective personalized learning in...

Vulnerability of the rng_get_data() function in the drivers/char/hw_random/core.c module – A driver for supporting alphanumeric devices in the Linux kernel, which allows a hacker to cause a service failure.

Vulnerability of the rnggetdata function in the drivers/char/hwrandom/core.c module – The Linux kernel’s driver for supporting alphanumeric devices is vulnerable to synchronization errors when using shared resources. Exploiting this vulnerability can allow an attacker to cause a service failure...