480 matches found
EUVD-2022-39557
Malicious code in bioql PyPI...
EUVD-2022-39552
Malicious code in bioql PyPI...
EUVD-2022-38177
Malicious code in bioql PyPI...
EUVD-2021-7860
Malicious code in bioql PyPI...
EUVD-2023-55677
Malicious code in bioql PyPI...
EUVD-2022-6324
Malicious code in bioql PyPI...
EUVD-2025-25631
Malicious code in bioql PyPI...
EUVD-2025-27610
Malicious code in bioql PyPI...
EUVD-2025-25124
Malicious code in bioql PyPI...
GHSA-F7QG-XJ45-W956 Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark
Impact A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF. Vulnerable versions This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8. Patches v5.130.4 and v6.0.9 contain a fix for this issue. Referenc...
Ghost vulnerable to Server Side Request Forgery (SSRF) via oEmbed Bookmark
Impact A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF. Vulnerable versions This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8. Patches v5.130.4 and v6.0.9 contain a fix for this issue. Referenc...
CVE-2025-8557
An internal product security audit of Lenovo XClarity Orchestrator LXCO discovered the below vulnerability: An attacker with access to a device on the local Lenovo XClarity Orchestrator LXCO network segment may be able to manipulate the local device to create an alternate communication channel...
CVE-2025-54376
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time applicatio...
CVE-2025-8557
CVE-2025-8557 concerns Lenovo XClarity Orchestrator (LXCO). An attacker with access to a device on the local LXCO network segment can manipulate that device to create an alternate communication channel, enabling direct interaction with backend LXCO API services that are normally inaccessible to u...
Lenovo XClarity Orchestrator security vulnerabilities
Lenovo XClarity Orchestrator is an application from the Chinese company Lenovo Lenovo. It provides centralized monitoring, management, and analysis for environments containing a large number of devices. A security vulnerability exists in Lenovo XClarity Orchestrator that originates in a local...
CVE-2025-54376
Hoverfly is an open source API simulation tool. In versions 1.11.3 and prior, Hoverfly’s admin WebSocket endpoint /api/v2/ws/logs is not protected by the same authentication middleware that guards the REST admin API. Consequently, an unauthenticated remote attacker can stream real-time applicatio...
CVE-2025-7426
Information disclosure and exposure of authentication FTP credentials over the debug port 1604 in the MINOVA TTA service. This allows unauthenticated remote access to an active FTP account containing sensitive internal data and import structures. In environments where this FTP server is part of...
CVE-2023-7307 Sangfor Behavior Management System XML External Entity Injection
Sangfor Behavior Management System also referred to as DC Management System in Chinese-language documentation contains an XML external entity XXE injection vulnerability in the /src/sangforindex endpoint. A remote unauthenticated attacker can submit crafted XML data containing external entity...
CVE-2025-7813
CVE-2025-7813 refers to the Eventin plugin for WordPress (The Events Calendar, Event Booking, Registrations and Event Tickets) where SSRF exists in all versions up to 4.0.37 via the proxy_image function. The vulnerability allows unauthenticated attackers to make web requests from the application ...
CVE-2025-33100
IBM Concert Software 1.0.0 through 1.1.0 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data...