PT-2025-23310 · Unknown · Com.Pri.Factorytest

Name of the Vulnerable Software and Affected Versions: com.pri.factorytest versions 1.0 Android smartphones from Ulefone and Krüger&Matz affected versions not specified Description: The issue concerns an application "com.pri.factorytest" preloaded onto Android smartphones from vendors such as...

HCL Traveler 代码问题漏洞

HCL Traveler is a software from HCL India. It is used to provide automatic, bi-directional, wireless synchronization between HCL Domino servers and wireless handheld devices. A security vulnerability exists in HCL Traveler that stems from vulnerability to DLL hijacking attacks...

USN-7513-5 linux-oracle-6.8 vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - RISC-V architecture; - x86 architecture; - Block layer subsystem; - Compute Acceleration Framework; - ACPI drivers;...

CVE-2025-41649

An unauthenticated remote attacker can exploit insufficient input validation to write data beyond the bounds of a buffer, potentially leading to a denial-of-service condition for the devices...

CVE-2025-22377

An issue was discovered in Samsung Mobile Processor, Wearable Processor, and Modem Exynos 980, 990, 850, 1080, 2100, 1280, 2200, 1330, 1380, 1480, 2400, 9110, W920, W930, W1000, Modem 5123, Modem 5300, Modem 5400. A Heap-based Out-of-Bounds Write exists in the GPRS protocol implementation because...

New PumaBot Botnet Targets Linux IoT Devices to Steal SSH Credentials and Mine Crypto

Embedded Linux-based Internet of Things IoT devices have become the target of a new botnet dubbed PumaBot. Written in Go, the botnet is designed to conduct brute-force attacks against SSH instances to expand in size and scale and deliver additional malware to the infected hosts. "Rather than...

USN-7510-7 linux-aws, linux-intel-iotg-5.15, linux-nvidia-tegra-igx, linux-raspi vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Network block device...

Malicious code in rm-api-services (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea2d07f3cf2fca9f2d9c28bb289065312eb770f303ac487e0ffe75bba11604a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

How to load unsigned or fake-signed apps on iOS

TL;DR Issues commonly arise when clients provide an application which is unsigned or does not meet device requirements. Installing an application can be challenging without a Mac, access to Xcode or if the client is having trouble signing the application manually as this is normally done by the a...

📄 Remote for Mac 2025.6 Unauthenticated Arbitrary Input

Remote for Mac version 2025.6 allows for unauthenticated arbitrary input into the active window. Exploit Title: Remote for Mac 2025.6 - Unauthenticated Arbitrary Input into Active Window Date: 2025-05-28 Exploit Author: Chokri Hammedi Vendor Homepage: https://cherpake.com/ Software Link:...

AMD uProf Connection Point Vulnerability

AMD uProf is a suite of performance analysis tools from AMD for analyzing the performance of x86 architecture applications on Windows, Linux and FreeBSD systems. AMD uProf suffers from a connection point vulnerability that can be exploited by attackers to cause arbitrary file deletion or disclosu...

FIDO2 Authentication Does Not Work With Webpages Opened Using Microsoft Edge

Users are not able to Authenticate to a website that requires FIDO2 Authentication using a Yubikey when using Edge on VDA Devices. The users are constantly prompted to select a Smartcard device. The same users are able to Authenticate onto the same website using Chrome or Firefox inside the same...

CVE-2025-5066

Inappropriate implementation in Messages in Google Chrome on Android prior to 137.0.7151.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. Chromium security severity: Medium...

USN-7510-6 linux-aws-fips vulnerabilities

Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in the following subsystems: - ARM64 architecture; - PowerPC architecture; - x86 architecture; - Block layer subsystem; - Network block device...

CVE-2025-5145

A vulnerability, which was classified as critical, was found in Netcore NBR1005GPEV2, B6V2, COVER5, NAP830, NAP930, NBR100V2, NBR200V2 and POWER13 up to 20250508. This affects an unknown part of the file /www/cgi-bin/ of the component Query String Handler. The manipulation leads to command...

Malicious code in @cyb3rsh4ykh/neondatabase (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8818d3e8d2cad629da889fec7789a75afe9aec10fa5ca1cab5a15828ab8f657 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2025-22975 · Apache · Apache Http Server

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server affected versions not specified Description: The issue concerns a credentials disclosure problem. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where...

Malicious code in ideals-types (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 01d29c96c89fba87bb3cf0cd09ee9fbca6559fe81267c0e61f61b5c3054b28c0 Any computer that has this package installed or running should be considered...

Malicious code in html-report (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 76dfd70352bf673a00030f6d35ad320bc633fad730881d95d897d878d7ce662b Any computer that has this package installed or running should be considered...

MAL-2025-4564 Malicious code in iot-sdk-device-client-rest-api (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b7292c16917957be9e3511b347ab46a5b84d68d182f759d96859e22b934d013f Any computer that has this package installed or running should be considered...