Malicious code in spiderai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cfee8e74f278d45135c11ee4ff3f18180cb2423e333934a8ba994f5e8ec48b9a Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...

SUSE CVE-2024-9391

A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing of other sites as the address bar is no longer visible. This bug only affects Firefox Focus for Android. Other versions of Firefox are...

UBUNTU-CVE-2024-9395

A specially crafted filename containing a large number of spaces could obscure the file's extension when displayed in the download dialog. This bug only affects Firefox for Android. Other versions of Firefox are unaffected. This vulnerability affects Firefox 131...

golang: archive/zip: Incorrect handling of certain ZIP files

A flaw was found in Golang. The ZIP implementation of the Go language archive/zip library behaves differently than the rest of the ZIP file format implementations. When handling ZIP files with a corrupted central directory record, the library skips over the invalid record and processes the next...

cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email,...

PT-2024-7792

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 131 Firefox Focus for Android versions prior to 131 Description A user who enables full-screen mode on a specially crafted web page could potentially be prevented from exiting full screen mode. This may allow spoofing...

CVE-2024-28812

An issue was discovered in Infinera hiT 7300 5.60.50. A hidden SSH service on the local management network interface with hardcoded credentials allows attackers to access the appliance operating system with highest privileges via an SSH connection...

PT-2024-22580 · Infinera · Infinera Hit 7300

Name of the Vulnerable Software and Affected Versions: Infinera hiT 7300 version 5.60.50 Description: An issue was discovered in the web interface of the affected software, which contains hidden functionality. This allows a remote authenticated attacker to access reserved information by accessing...

Infinera hiT 7300 安全漏洞

The Infinera hiT 7300 is a software-defined networking SDN-ready coherent packet-optical transport system from Infinera USA. A security vulnerability exists in the Infinera hiT 7300 version 5.60.50 that stems from a hidden SSH service with hard-coded credentials that allows an attacker to access...

Malicious code in botnetv2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c81380140d3b7a9d5dddf19a386bb1fc8b9b55044fefc32997fc3d2af9969fcb When running the module, basic information about the user and its location are collected and sent to the author. This is hidden from the user as the package...

Multiple vulnerabilities in TAKENAKA ENGINEERING digital video recorders

Overview Multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. contain multiple vulnerabilities listed below. Improper authentication CWE-287 - CVE-2024-41929 OS command injection CWE-78 - CVE-2024-43778 Hidden functionality CWE-912 - CVE-2024-47001 Yoshiki Mori, Ushimaru...

Censys Uncovers Hidden Infrastructure of Iranian Fox Kitten Group

Censys uncovers the hidden infrastructure of Fox Kitten, an Iranian cyberespionage group. It reveals unique patterns, potential new…...

CVE-2024-47001

Hidden functionality issue in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings...

CVE-2024-47001

The CVE-2024-47001 entry concerns a Hidden functionality issue in TAKENAKA ENGINEERING CO., LTD. digital video recorders. Connected sources confirm the vulnerability affects multiple TAKENAKA models (e.g., HDVR-400, HDVR-800, HDVR-1600, AHD04T-A/AHD08T-A/AHD16T-A, NVR04T-A/NVR08T-A, NVR16T-A, wit...

CVE-2024-47001

Hidden functionality issue in multiple digital video recorders provided by TAKENAKA ENGINEERING CO., LTD. allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter the device settings...

TAKENAKA ENGINEERING多款产品 安全漏洞

TAKENAKA ENGINEERING HDVR-400 and others are a digital video recorder from TAKENAKA ENGINEERING. A security vulnerability exists in various TAKENAKA ENGINEERING products, which stems from a hidden functionality issue that could allow a remote, authenticated attacker to execute arbitrary operating...

CVE-2024-45697

Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote attackers can log in and execute OS commands using hard-coded credentials...

CVE-2024-45696

Certain models of D-Link wireless routers contain hidden functionality. By sending specific packets to the web service, the attacker can forcibly enable the telnet service and log in using hard-coded credentials. The telnet service enabled through this method can only be accessed from within the...

CVE-2024-45696

Certain models of D-Link wireless routers contain hidden functionality. By sending specific packets to the web service, the attacker can forcibly enable the telnet service and log in using hard-coded credentials. The telnet service enabled through this method can only be accessed from within the...

CVE-2024-45697 D-Link WiFi router - Hidden Functionality

Certain models of D-Link wireless routers have a hidden functionality where the telnet service is enabled when the WAN port is plugged in. Unauthorized remote attackers can log in and execute OS commands using hard-coded credentials...