CVE-2025-24345

CVE-2025-24345 affects ctrlX OS web application’s Hosts functionality. A remote authenticated (low-privileged) attacker can manipulate the hosts file via a crafted HTTP request, indicating improper input/authorization handling in the Hosts feature. CVSSv3.1 base score is 6.3 (MEDIUM) with network...

CVE-2025-24345

A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to manipulate the “hosts” file in an unintended manner via a crafted HTTP request...

CVE-2025-24345

A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to manipulate the “hosts” file in an unintended manner via a crafted HTTP request...

Malicious code in internal-payroll-lib-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7f2f9ac4669489d305522859900c9fc0c92c656de17f018f9369aee637348083 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Bosch Rexroth ctrlX OS 安全漏洞

Bosch Rexroth ctrlX OS is a Linux-based real-time operating system from Bosch Rexroth, an open control platform designed for industrial automation equipment. A security vulnerability exists in Bosch Rexroth ctrlX OS that stems from improper Hosts functionality, which could lead to tampering of th...

Malicious code in nsemea-purchaseorder-lib-poc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1bf53835fe6b37e19bb183ba2e3ffc37ceeac570440ff7e4272b3e2f6dae377c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation during SSH connections if the certificate isn’t set in the knownhosts file. An attacker can intercept and manipulate data by positioning themselves between the client and server, effectively conducting a...

PT-2025-18259 · Ctrlx Os · Ctrlx Os

Name of the Vulnerable Software and Affected Versions: ctrlX OS affected versions not specified Description: A vulnerability in the “Hosts” functionality of the web application of ctrlX OS allows a remote authenticated low-privileged attacker to manipulate the “hosts” file in an unintended manner...

cve

Vulnerability Title: Arbitrary File Read in QCMS Authenticate...

Malicious code in bespoke-it (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50c8574065c05dfb54a421ce73341ceff847e8acdccdc1a8e800d12e6aee9f05 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EulerOS 2.0 SP11 : wget (EulerOS-SA-2025-1382)

According to the versions of the wget package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Applications that use Wget to access a remote resource using shorthand URLs and pass arbitrary user credentials in the URL are vulnerable. In these...

Vulnerability fixed in FortiSwitch

Fortinet has fixed a vulnerability in the FortiSwitch GUI. The vulnerability with reference CVE-2024-48887, is located in the FortiSwitch GUI, which allows a remote, unauthenticated malicious person to change admin passwords via specially crafted requests. This security issue can lead to...

Malicious code in scatterpie (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4308e49dfcf49f89b83f3fb963bed64aed858409e2256b461e06686bbfbc616a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fortinet Urges FortiSwitch Upgrades to Patch Critical Admin Password Change Flaw

Fortinet has released security updates to address a critical security flaw impacting FortiSwitch that could permit an attacker to make unauthorized password changes. The vulnerability, tracked as CVE-2024-48887 , carries a CVSS score of 9.3 out of a maximum of 10.0. "An unverified password change...

Malicious code in chickenisgood (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a1270418b58d2289ebd542f7a04a3089bd20b78e65cfb2a4d708020d1886bb69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in clarunit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aecdc65ad87798f6243b3d284367e755b52beb5eef68fcc0ca08b0b802230643 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in rapyd-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 824016d2b7d246c5d458bbc5e7049f1233aa5289743b511bf1c1096dba58aefd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nva-direct-showof (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6d8b4952e45ae0f21b713b389d983c27d4b09a8410a0416bfd8efb2b2923ff02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-223J-4RM8-MRMF Next.js may leak x-middleware-subrequest-id to external hosts

Summary In the process of remediating CVE-2025-29927, we looked at other possible exploits of Middleware. We independently verified this low severity vulnerability in parallel with two reports from independent researchers. Learn more here. Credit Thank you to Jinseo Kim kjsman and RyotaK GMO Flat...

CVE-2025-30218 Next.js may leak x-middleware-subrequest-id to external hosts

Next.js is a React framework for building full-stack web applications. To mitigate CVE-2025-29927, Next.js validated the x-middleware-subrequest-id which persisted across multiple incoming requests. However, this subrequest ID is sent to all requests, even if the destination is not the same host ...