os/exec: Unexpected paths returned from LookPath in os/exec

A path handling flaw has been discovered in the os/exec go package. If the PATH environment variable contains paths which are executables rather than just directories, passing certain strings to LookPath "", ".", and "..", can result in the binaries listed in the PATH being unexpectedly returned...

EUVD-2025-198892

A reflected cross-site scripting XSS vulnerability in the /overview/network/ endpoint of Austrian Archaeological Institute Openatlas before v8.12.0 allows attackers to execute arbitrary code in the context of a user's browser via injecting a crafted payload into the charge parameter...

CVE-2025-66108

Missing Authorization vulnerability in Merlot Digital by TNC TNC Toolbox: Web Performance tnc-toolbox allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TNC Toolbox: Web Performance: from n/a through = 2.0.4...

TencentOS Server 4: pure-ftpd (TSSA-2025:0246)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0246 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2025-13275 Iqbolshoh php-business-website about.php unrestricted upload

A security vulnerability has been detected in Iqbolshoh php-business-website up to 10677743a8dfc281f85291a27cf63a0bce043c24. This affects an unknown part of the file /admin/about.php. The manipulation leads to unrestricted upload. It is possible to initiate the attack remotely. The exploit has be...

curl: Malicious server forces .curlrc creation via curl -OJ leading to local file exfiltration

Summary: When a user runs curl -OJ , a malicious server can force the response to be saved as .curlrc in the working directory. If the user executes the download from their home directory a common workflow, the attacker overwrites /.curlrc. Subsequent curl invocations automatically load this...

CVE-2025-23143 affecting package kernel for versions less than 6.6.112.1-2

CVE-2025-23143 affecting package kernel for versions less than 6.6.112.1-2. An upgraded version of the package is available that resolves this issue...

EUVD-2025-197651

Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...

CVE-2025-63680

Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...

CVE-2025-63680

Nero BackItUp in the Nero Productline is vulnerable to a path parsing/UI rendering flaw CWE-22 that, in combination with Windows ShellExecuteW fallback extension resolution, leads to arbitrary code execution when a user clicks a crafted entry. By creating a trailing-dot folder and placing a...

CVE-2025-63680

Nero BackItUp (Nero Productline) is affected by a path parsing/UI rendering flaw (CWE-22) that, in conjunction with Windows ShellExecuteW fallback extension resolution, enables arbitrary code execution when a user clicks a crafted entry. The mechanism: create a trailing-dot folder and place a scr...

Siemens SIMATIC S7-1500 Missing Encryption of Sensitive Data (CVE-2022-27779)

libcurl wrongly allows cookies to be set for Top Level Domains TLDs if thehost name is provided with a trailing dot.curl can be told to receive and send cookies. curl's cookie engine can bebuilt with or without Public Suffix Listawareness. If PSL support not provided, a more rudimentary check...

Siemens SIMATIC S7-1500 Cleartext Transmission of Sensitive Information (CVE-2022-30115)

Using its HSTS support, curl can be instructed to use HTTPS directly insteadof using an insecure clear-text HTTP step even when HTTP is provided in theURL. This mechanism could be bypassed if the host name in the given URL used atrailing dot while not using one when it built the HSTS cache. Or th...

About the security content of Compressor 4.11.1

About the security content of Compressor 4.11.1 This document describes the security content of Compressor 4.11.1. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases ar...

Malicious code in itale-adci-ggpanekyu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b0bb3e75b240082accea45fa79ee046de1da323c0c72726f296b8646669449 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-181679 Malicious code in astam-ift-dinuhkouhgoa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 53ca128cefe38eae4ab6a7a1562fd686c134a74a8ee4871aa42e28b1b1401993 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in lookingan-jaja2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9fb295f4a4e38c104c9222d7e764afa2575653fe50046528b891dddbf78c9dac This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-180054 Malicious code in teate-thy-py-dulna (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d7776cb937480514dc004cc5ded1a11f860da618eba61b6a83451262aa83e1f4 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in erftads-eredd-trufd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3693b1433880712b3f4871fc98240590fe418288703e30316ffb3ef56e68a650 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-175202 Malicious code in kapvino-socovni-fafgsffsgfi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1f0db04b06c7fd4afb67b4c627806a7293bc62c457442601bbebffc4b5e4b01 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...