ScarCruft Uses RokRAT Malware in Operation HanKook Phantom Targeting South Korean Academics

Cybersecurity researchers have discovered a new phishing campaign undertaken by the North Korea-linked hacking group called ScarCruft aka APT37 to deliver a malware known as RokRAT. The activity has been codenamed Operation HanKook Phantom by Seqrite Labs, stating the attacks appear to target...

Path Traversal

tinyscientist is vulnerable to path Traversal. The vulnerability is due to improper validation of file paths in the reviewpaper function, which allows an attacker to craft malicious file paths to read arbitrary PDF files on the server, access sensitive documents, and perform reconnaissance on the...

Linux Distros Unpatched Vulnerability : CVE-2024-4568

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Xpdf 4.05 and earlier, a PDF object loop in the PDF resources leads to infinite recursion and a stack overflow. CVE-2024-4568 Note that Nessus relies on the...

Linux Distros Unpatched Vulnerability : CVE-2022-43071

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A stack overflow in the Catalog::readPageLabelTree2Object function of XPDF v4.04 allows attackers to cause a Denial of Service DoS via a crafted PDF file...

Linux Distros Unpatched Vulnerability : CVE-2021-31804

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LeoCAD before 21.03 sometimes allows a use-after-free during the opening of a new document. CVE-2021-31804 Note that Nessus relies on the presence of the packag...

Linux Distros Unpatched Vulnerability : CVE-2020-24999

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - There is an invalid memory access in the function fprintf located in Error.cc in Xpdf 4.0.2. It can be triggered by sending a crafted PDF file to the pdftohtml...

Linux Distros Unpatched Vulnerability : CVE-2025-27406

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga Reporting is the central component for reporting related functionality in the monitoring web frontend and framework Icinga Web 2. A vulnerability present...

Linux Distros Unpatched Vulnerability : CVE-2019-9658

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Checkstyle before 8.18 loads external DTDs by default. CVE-2019-9658 Note that Nessus relies on the presence of the package as reported by the vendor...

CLSA-2025-1756409595 clamav: Fix of 4 CVEs

Update to 1.4.3 LTS - CVE-2025-20260: Fixed a possible buffer overflow write bug in the PDF file parser - CVE-2025-20234: Fixed a possible buffer overflow read bug in the UDF file parser - CVE-2025-20128: Fixed a possible buffer overflow read bug in the OLE2 file parser - CVE-2024-20506: Changed...

CVE-2025-58049

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions from 14.4.2 to before 16.4.8, 16.5.0-rc-1 to before 16.10.7, and 17.0.0-rc-1 to before 17.4.0-rc-1, the PDF export jobs store sensitive cookies unencrypted in job statuses. XWiki...

XWiki Platform 安全漏洞

XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform versions prior to 16.4.8 and 17.4.0-rc-1, which stems from the unencrypted storage of sensitive cookies in PDF export jobs...

CVE-2025-58212

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in epeken Epeken All Kurir epeken-all-kurir allows DOM-Based XSS.This issue affects Epeken All Kurir: from n/a through = 2.0.1...

CVE-2025-58212 WordPress Epeken All Kurir Plugin <= 2.0.1 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in epeken Epeken All Kurir epeken-all-kurir allows DOM-Based XSS.This issue affects Epeken All Kurir: from n/a through = 2.0.1...

CVE-2025-58212

The CVE-2025-58212 entry concerns a DOM-Based XSS in the WordPress plugin Epeken All Kurir (WooCommerce), caused by improper input neutralization during web page generation. Affected versions are up to 2.0.1; a fix is available in later releases (update to a version later than 2.0.1). The CVSS 3....

CVE-2025-58205

CVE-2025-58205 refers to a DOM-based Cross-Site Scripting vulnerability in the WordPress plugin ElementInvader Addons for Elementor (affected: versions up to 1.3.6). The issue arises from improper input neutralization during web page generation, enabling XSS. Publicly documented details in connec...

We Are Still Unable to Secure LLMs from Malicious Inputs

Nice indirect prompt injection attack: Bargury's attack starts with a poisoned document, which is shared to a potential victim's Google Drive. Bargury says a victim could have also uploaded a compromised file to their own account. It looks like an official document on company meeting policies. Bu...

CGA-3VCP-56CF-5R8Q

Bulletin has no description...

CVE-2025-30057

Technical details about CVE-2025-30057 are not publicly provided in the supplied documents. Monitor for updates when new information becomes available.

CVE-2025-7732

CVE-2025-7732: The WordPress plugin Lazy Load for Videos (

Linux Distros Unpatched Vulnerability : CVE-2024-52035

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An integer overflow vulnerability exists in the OLE Document File Allocation Table Parser functionality of catdoc 0.95. A specially crafted malformed file can...