PT-2025-13964 · Apple · Ios +1

Name of the Vulnerable Software and Affected Versions: iOS versions prior to 18.4 iPadOS versions prior to 18.4 iPadOS versions prior to 17.7.6 Description: The issue allows photos in the Hidden Photos Album to be viewed without authentication. This was addressed through improved state management...

Apple iOS和Apple iPadOS 安全漏洞

Apple iOS and Apple iPadOS are products of Apple Inc. Apple iOS is an operating system developed for mobile devices, and Apple iPadOS is an operating system for iPad tablets. A security vulnerability exists in Apple iOS and Apple iPadOS, which arises from the possibility that photos in hidden...

The vulnerability of the OpenSSL library, related to the hidden time channel, allows a hacker to recover the secret key.

The vulnerability of the OpenSSL library is related to a hidden time channel. Exploiting this vulnerability allows a malicious actor, operating remotely, to recover the secret key...

PT-2025-14481

Name of the Vulnerable Software and Affected Versions Moodle affected versions not specified Description A flaw has been identified where insufficient capability checks in certain grade reports allowed users without the necessary permissions to access hidden grades. Recommendations At the moment,...

horticus.biz Cross Site Scripting vulnerability OBB-4038403

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

The Hidden Costs and Ethical Pitfalls of Content Scraping

Read about the significant hidden costs and ethical pitfalls of content scraping — and learn how to protect your website...

SpyCloud’s 2025 Identity Exposure Report Reveals the Scale and Hidden Risks of Digital Identity Threats

Austin, TX, United States, 19th March 2025, CyberNewsWire...

The vulnerability of the PHP programming language interpreter, related to deficiencies in handling HTTP request headers, allows attackers to send hidden HTTP requests (HTTP Request Smuggling attack).

The vulnerability of the PHP programming language interpreter is related to deficiencies in the processing of HTTP request headers. Exploiting this vulnerability allows a malicious actor to send hidden HTTP requests a type of HTTP Request Smuggling attack...

CVE-2025-27840

Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 Write memory...

CVE-2025-27840

Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 Write memory...

Espressif ESP32 安全漏洞

Espressif ESP32 is a microcontroller from China Loxin Espressif. A security vulnerability exists in the Espressif ESP32 that stems from hidden HCI commands that may result in memory writes...

CVE-2025-27840

CVE-2025-27840 concerns Espressif ESP32 family chips. The public materials describe 29 hidden HCI/debug commands (notably 0xFC02: Write memory) that are undocumented and could enable memory writes in affected devices. Espressif explicitly states these are internal debug commands not remotely acce...

CVE-2025-27840

Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 Write memory...

hidden-3d.com Cross Site Scripting vulnerability OBB-4033443

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

DEBIAN-CVE-2025-1936

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension...

UBUNTU-CVE-2025-1936

jar: URLs retrieve local file content packaged in a ZIP archive. The null and everything after it was ignored when retrieving the content from the archive, but the fake extension after the null was used to determine the type of content. This could have been used to hide code in a web extension...

Linux Distros Unpatched Vulnerability : CVE-2018-0495

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Libgcrypt before 1.7.10 and 1.8.x before 1.8.3 allows a memory-cache side-channel attack on ECDSA signatures that can be mitigated through the use of blinding...

PyTorch Model Files Can Bypass Pickle Scanners via Unexpected Pickle Extensions

CVE-2025-1889 Summary Picklescan fails to detect hidden pickle files embedded in PyTorch model archives due to its reliance on file extensions for detection. This allows an attacker to embed a secondary, malicious pickle file with a non-standard extension inside a model archive, which remains...

Information Disclosure

moodle/moodle is vulnerable to Information Disclosure. The vulnerability is due to inadequate restrictions on tag visibility, which allows users to access and discover hidden tags through the tag search page or tags block...

MAL-2025-191871 Malicious code in snapshot-photo (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 61ed09e2fa2143dedd945c585d917ad8d7b55d7118e5093430b48c5c02d126f8 This campaign is built from two parts: 1 packages named like time-check-server, snapshot-photo contain an innocent-looking code that sends "date" to a remote...