Linux Distros Unpatched Vulnerability : CVE-2020-13670

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Information Disclosure vulnerability in file module of Drupal Core allows an attacker to gain access to the file metadata of a permanent private file that they ...

Linux Distros Unpatched Vulnerability : CVE-2023-3247

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In PHP versions 8.0. before 8.0.29, 8.1. before 8.1.20, 8.2. before 8.2.7 when using SOAP HTTP Digest Authentication, random value generator was not checked for...

MAL-2025-22036 Malicious code in guess_the_number-732161 (npm)

The package guessthenumber-732161 was found to contain malicious code...

MAL-2025-22034 Malicious code in guess-smartphone (npm)

The package guess-smartphone was found to contain malicious code...

Malicious code in guess-smartphone (npm)

The package guess-smartphone was found to contain malicious code...

Malicious code in guess-pets (npm)

The package guess-pets was found to contain malicious code...

MAL-2025-22032 Malicious code in guess-iq (npm)

The package guess-iq was found to contain malicious code...

Malicious code in guess-ideology (npm)

The package guess-ideology was found to contain malicious code...

Malicious code in guess-iq (npm)

The package guess-iq was found to contain malicious code...

Malicious code in guess-zodiac (npm)

The package guess-zodiac was found to contain malicious code...

MAL-2025-22031 Malicious code in guess-ideology (npm)

The package guess-ideology was found to contain malicious code...

MAL-2025-22033 Malicious code in guess-pets (npm)

The package guess-pets was found to contain malicious code...

MAL-2025-22035 Malicious code in guess-zodiac (npm)

The package guess-zodiac was found to contain malicious code...

GHSA-QJXF-MC72-WJR2 Devise-Two-Factor Authentication Uses Insufficient Default OTP Shared Secret Length

Summary Under the default configuration, Devise-Two-Factor versions 1.0.0 or = 4.0.0 & 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make ...

CVE-2024-8796 Insufficient Default OTP Shared Secret Length

Under the default configuration, Devise-Two-Factor versions = 2.2.0 & 6.0.0 generate TOTP shared secrets that are 120 bits instead of the 128-bit minimum defined by RFC 4226. Using a shared secret shorter than the minimum to generate a multi-factor authentication code could make it easier for an...

CVE-2024-34113 ColdFusion | Weak Cryptography for Passwords (CWE-261)

ColdFusion versions 2023u7, 2021u13 and earlier are affected by a Weak Cryptography for Passwords vulnerability that could result in a security feature bypass. This vulnerability arises due to the use of insufficiently strong cryptographic algorithms or flawed implementation that compromises the...

CVE-2024-5690

By monitoring the time certain operations take, an attacker could have guessed which external protocol handlers were functional on a user's system. This vulnerability affects Firefox 127, Firefox ESR 115.12, and Thunderbird 115.12...

WordPress Core plugin <= 6.4.3 - Sensitive Information Exposure via redirect_guess_404_permalink vulnerability

Sensitive Information Exposure via redirectguess404permalink vulnerability discovered by Francesco Carlucci in WordPress core versions = 6.4.3...

PT-2024-14827 · WordPress +1 · Wordpress +1

Name of the Vulnerable Software and Affected Versions: WordPress Core versions up to, and including, 6.4.3 Description: The issue allows unauthenticated attackers to expose the slug of a custom post whose publicly queryable post status has been set to 'false' via the redirect guess 404 permalink...

CVE-2024-1729

The CVE-2024-1729 entry concerns a timing-attack vulnerability in gradio-app/gradio, specifically in the login workflow (routes.py) where credentials are validated with a direct comparison (app.auth[username] == password). This timing discrepancy can allow an attacker to guess valid credentials b...