13458 matches found
WordPress WP Email Delivery plugin <= 1.20.11.23 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by 0xd4rk5id3 in WordPress Plugin WP Email Delivery versions = 1.20.11.23...
CVE-2025-30066
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code...
GHSA-MRRH-FWG8-R2C3 tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
Summary A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and...
tj-actions changed-files through 45.0.7 allows remote attackers to discover secrets by reading actions logs.
Summary A supply chain attack compromised the tj-actions/changed-files GitHub Action, impacting over 23,000 repositories. Attackers retroactively modified multiple version tags to reference a malicious commit, exposing CI/CD secrets in workflow logs. The vulnerability existed between March 14 and...
CVE-2025-30066
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code...
Malicious PyPI Packages Stole Cloud Tokens—Over 14,100 Downloads Before Removal
Cybersecurity researchers have warned of a malicious campaign targeting users of the Python Package Index PyPI repository with bogus libraries masquerading as "time" related utilities, but harboring hidden functionality to steal sensitive data such as cloud access tokens. Software supply chain...
CVE-2025-30066
tj-actions changed-files before 46 allows remote attackers to discover secrets by reading actions logs. The tags v1 through v45.0.7 were affected on 2025-03-14 and 2025-03-15 because they were modified by a threat actor to point at commit 0e58ed8, which contained malicious updateFeatures code...
CVE-2025-30066
CVE-2025-30066 affects tj-actions/changed-files before 46, where a malicious commit (0e58ed8) was used to alter tags (e.g., v1, v45.0.7) and cause secrets to be read from GitHub Actions logs. Public reports and advisories (CISA, OSV, GHSA) confirm secrets disclosure via runners’ logs in affected ...
CVE-2025-29030
creationtimestamp| type| source ---|---|--- 2025-03-14 14:45:30+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/7569 2025-03-14 16:42:30+00:00| seen| https://t.me/cvedetector/20298 2025-03-14 16:46:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lke2qh4s5...
sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy
...
CVE-2024-34398
creationtimestamp| type| source ---|---|--- 2025-03-12 17:41:39+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7349 2025-03-12 19:25:40+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lk7cpu7lmi2n 2025-03-12 20:22:57+00:00| seen| https://t.me/cvedetector/20149...
PT-2025-11055 · Google · Android
Name of the Vulnerable Software and Affected Versions: sdp discovery affected versions not specified Description: A use after free issue exists in the process service attr rsp function of sdp discovery.cc. This could lead to remote code execution without requiring additional privileges or user...
Palo Alto Networks PAN-OS 安全漏洞
Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks, Inc. for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS that originates from the processing of specially crafted LLDP frames that could cause the firewall to restart unexpected...
PT-2025-11066 · Google · Android
Name of the Vulnerable Software and Affected Versions: sdp discovery.cc affected versions not specified Description: A use-after-free issue exists in the sdp snd service search req function of sdp discovery.cc. This could lead to remote code execution without requiring additional privileges or us...
PT-2025-11074 · Google · Android
Name of the Vulnerable Software and Affected Versions: Bluetooth affected versions not specified Description: A use-after-free issue exists in the process service attr rsp function within sdp discovery.cc due to a logic error in the code. This could lead to remote code execution without requiring...
PT-2025-11056 · Google · Android
Name of the Vulnerable Software and Affected Versions: sdp server affected versions not specified Description: A use after free issue exists in the process service search attr req function within sdp server.cc. This could lead to remote code execution without requiring additional privileges or us...
Ubuntu 22.04 LTS / 24.04 LTS / 24.10 : .NET vulnerability (USN-7345-1)
The remote Ubuntu 22.04 LTS / 24.04 LTS / 24.10 host has packages installed that are affected by a vulnerability as referenced in the USN-7345-1 advisory. Zahid TOKAT discovered that .NET suffered from a weak authentication vulnerability. An attacker could possibly use this issue to elevate...
WordPress Lava Ajax Search plugin <= 1.1.9 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by Nabil Irawan in WordPress Plugin Lava Ajax Search versions = 1.1.9...
WordPress BP Email Assign Templates By shanebp plugin <= 1.6 - Cross-Site Scripting vulnerability
Cross-Site Scripting vulnerability discovered by ch4r0n in WordPress Plugin BP Email Assign Templates versions = 1.6...