329 matches found
EUVD-2020-12628
Malware in sbrugna...
EUVD-2021-0032
Malware in sbrugna...
EUVD-2012-1951
Malware in sbrugna...
EUVD-2006-6612
Malware in sbrugna...
EUVD-2024-49236
Malicious code in bioql PyPI...
EUVD-2023-42311
Malicious code in bioql PyPI...
CVE-2025-36857 Rapid7 Appspider Broken Access Control Vulnerability
Rapid7 Appspider Pro versions below 7.5.021, suffer from a broken access control vulnerability in the application's configuration file loading mechanism, whereby an attacker can place files in directories belonging to other users or projects. Affected versions allow standard users to add custom...
CVE-2025-10854 Symlink Following in txtai leads to arbitrary file write when loading untrusted embedding indices
The txtai framework allows the loading of compressed tar files as embedding indices. While the validate function is intended to prevent path traversal vulnerabilities by ensuring safe filenames, it does not account for symbolic links within the tar file. An attacker is able to write a file anywhe...
Remote Code Execution (RCE)
picklescan is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper handling of untrusted pickle data in the function’s reduce flow, which allows an attacker to craft a malicious pickle that bypasses the victim’s Picklescan check and achieve arbitrary code execution when t...
The vulnerability of the microprogramming software of industrial thermal printers SATO CL4NX Plus, CL6NX Plus, CL4NX-J Plus, and CL6NX-J Plus lies in the ability to load files of a harmful type without restrictions. This allows attackers to escalate their privileges and execute arbitrary code.
The vulnerability of microprogrammed industrial thermal printers such as SATO CL4NX Plus, CL6NX Plus, CL4NX-J Plus, and CL6NX-J Plus lies in the ability to load files of a malicious nature without limitation. Exploiting this vulnerability can allow an attacker to enhance their privileges and...
The vulnerability of the PHP-FPM (FastCGI Process Manager) processor in the Nighthawk WiFi 6 Router software allows a hacker to bypass security restrictions, execute arbitrary code, and gain full control over the system.
The vulnerability of the PHP-FPM FastCGI Process Manager processor in Nighthawk WiFi 6 Router RAX30 involves unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to bypass security restrictions, execute arbitrary code, or gain full control over the system...
The vulnerability of the resize() and text() methods of the ImageMagick framework, which are used for developing web systems and CodeIgniter applications, allows attackers to load arbitrary files.
The vulnerability of the resize and text methods of the ImageMagick framework used for developing web systems and CodeIgniter applications relates to the lack of measures taken to neutralize special elements used in the operating system command line. Exploiting this vulnerability allows a remote...
The vulnerability of the FreeScout support service management system, related to unlimited loading of dangerous type files, allows a hacker to execute arbitrary code.
The vulnerability of the FreeScout support service management system is related to the unlimited loading of dangerous files. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...
LLaMA-Factory 代码问题漏洞
LLaMA-Factory is a fine-tuned large-scale language model by a Chinese hoshi-hiyouga individual developer. A code issue vulnerability exists in LLaMA-Factory 0.9.3 and earlier versions, which stems from improper loading of vheadfile and could lead to remote code execution...
The vulnerability of the Advantive VeraCore cloud-based business process management system lies in its ability to allow unlimited loading of dangerous types of files, enabling attackers to gain unauthorized access to protected information.
The vulnerability of the Advantive VeraCore cloud-based business process management system is related to the unlimited loading of dangerous types of files. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...
The vulnerability of the file loading function in the Polarion ALM application lifecycle management tool allows attackers to carry out XSS attacks.
The vulnerability of the file loading function in the Polarion ALM application lifecycle management tool is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform XSS attacks remotely...
CVE-2023-5939
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users...
The vulnerability of the “kiosk” mode in the redos-kiosk-utils package of the RED OS operating system allows a intruder to execute arbitrary commands.
The vulnerability of the “kiosk” mode in the redos-kiosk-utils package of the RED OS operating system is related to deficiencies in restricting the loading of files of a dangerous type. Exploiting this vulnerability allows an attacker to execute arbitrary commands...
CVE-2022-25824
Improper access control vulnerability in BixbyTouch prior to version 2.2.00.6 in China models allows untrusted applications to load arbitrary URL and local files in webview...
CVE-2021-37938
It was discovered that on Windows operating systems specifically, Kibana was not validating a user supplied path, which would load .pbf files. Because of this, a malicious user could arbitrarily traverse the Kibana host to load internal files ending in the .pbf extension. Thanks to Dominic Coutur...