CVE-2025-32789: Exposure of Sensitive Information to an Unauthorized Actor

EspoCRM is an Open Source Customer Relationship Management software. Prior to version 9.0.7, users can be sorted by their password hash. This flaw allows an attacker to make assumptions about the hash values of other users stored in the password column of the user table, based on the results of t...

CVE-2025-32784

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized a...

CVE-2025-32784 conda-forge-webservices has an Unauthorized Artifact Modification Race Condition

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized a...

CVE-2025-32784 conda-forge-webservices has an Unauthorized Artifact Modification Race Condition

conda-forge-webservices is the web app deployed to run conda-forge admin commands and linting. In versions prior to 2025.4.10, a race condition vulnerability has been identified in the conda-forge-webservices component used within the shared build infrastructure. This vulnerability, categorized a...

Use of Weak Hash

Overview Affected versions of this package are vulnerable to Use of Weak Hash that allows GSSAPI messages using RC4-HMAC-MD5 to be spoofed by an attacker in a MitM position. The attacker can forge message integrity codes and tamper with messages by exploiting MD5 collisions. This is only...

AZL-60928 CVE-2025-3576 affecting package krb5 for versions less than 1.19.4-4

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This ma...

From Cyber Threat to Data Shield: Constructing Provably Secure File Erasure with Repurposed Ransomware Cryptography

Ransomware has emerged as a persistent cybersecurity threat,leveraging robust encryption schemes that often remain unbroken even after public disclosure of source code. Motivated by the technical resilience of such mechanisms, this paper presents SEER Secure and Efficient Encryption-based Erasure...

Blockchain Application in Metaverse: a Review

In recent years, the term Metaverse emerged as one of the most compelling concepts, captivating the interest of international companies such as Tencent, ByteDance, Microsoft, and Facebook. These company recognized the Metaverse as a pivotal element for future success and have since made significa...

Linux Kernel Heap Buffer Overflow DoS

The vulnerability of the inethashconnect function in the net/ipv4/inethashtables.c module of the Linux operating system’s IPv4 protocol implementation involves the exposure of confidential information. Exploiting this vulnerability could allow a remote attacker to gain access to protected...

SUSE CVE-2025-32395

Vite is a frontend tooling framework for javascript. Prior to 6.2.6, 6.1.5, 6.0.15, 5.4.18, and 4.5.13, the contents of arbitrary files can be returned to the browser if the dev server is running on Node or Bun. HTTP 1.1 spec RFC 9112 does not allow in request-target. Although an attacker can sen...

CVE-2024-13820

The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, which uses a hardcoded hash. This makes it possible for unauthenticated attackers to extract sensitive data including environment information...

CrushFTP AWS4-HMAC-SHA256 Bypass Privilege Escalation

The vulnerability of the AWS4-HMAC-SHA256 algorithm implementation in the cross-platform FTP server CrushFTP relates to the bypassing of authentication by using the default crushadmin account. Exploiting this vulnerability allows a malicious actor to circumvent security restrictions, gain access ...

CVE-2025-22009

creationtimestamp| type| source ---|---|--- 2025-04-08 14:00:04+00:00| seen| https://t.me/cvedetector/22453...

Description of the security update for Office 2016: April 8, 2025 (KB5002588)

Description of the security update for Office 2016: April 8, 2025 KB5002588 Applies To Office Standard 2016 Office Professional 2016 Office Professional Plus 2016 Office Home and Business 2016 Office Home and Student 2016 Summary This security update resolves a Microsoft Office remote code...

Description of the security update for Office 2016: April 8, 2025 (KB5002669)

Description of the security update for Office 2016: April 8, 2025 KB5002669 Applies To Office Professional Plus 2016 Office Professional 2016 Office Standard 2016 Office Home and Business 2016 Office Home and Student 2016 Summary This security update resolves a Microsoft Office elevation of...

Description of the security update for OneNote 2016: April 8, 2025 (KB5002622)

Description of the security update for OneNote 2016: April 8, 2025 KB5002622 Applies To OneNote 2016 Summary This security update resolves a Microsoft OneNote security feature bypass vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures...

Description of the security update for Office Online Server: April 8, 2025 (KB5002699)

Description of the security update for Office Online Server: April 8, 2025 KB5002699 Applies To Office Online Server Summary This security update resolves a Microsoft Excel remote code execution vulnerability and Microsoft Office remote code execution vulnerability. To learn more about the...

Description of the security update for Office 2016: April 8, 2025 (KB5002703)

Description of the security update for Office 2016: April 8, 2025 KB5002703 Applies To Office Standard 2016 Office Professional 2016 Office Professional Plus 2016 Office Home and Business 2016 Office Home and Student 2016 Summary This security update resolves a Microsoft Office remote code...

Description of the security update for Access 2016: April 8, 2025 (KB5002701)

Description of the security update for Access 2016: April 8, 2025 KB5002701 Applies To Access 2016 Summary This security update resolves a Microsoft Office remote code execution vulnerability. To learn more about the vulnerability, see Microsoft Common Vulnerabilities and Exposures CVE-2025-26642...

CVE-2024-13820

The Melhor Envio plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.15.11 via the 'run' function, which uses a hardcoded hash. This makes it possible for unauthenticated attackers to extract sensitive data including environment information...