CVE-2025-56577

CVE-2025-56577 describes a vulnerability in Evope Core v1.1.3.20 where a local attacker can obtain sensitive information due to the use of hard-coded cryptographic keys. The available connected sources corroborate the affected product/version and the cryptographic-key issue, with CVSSv3.1 base sc...

Evope Core 安全漏洞

Evope Core is a base module for a process platform from Evope Brazil. A security vulnerability exists in Evope Core version 1.1.3.20, which stems from the use of hard-coded encryption keys and could lead to the disclosure of sensitive information...

CVE-2025-56577

An issue in Evope Core v.1.1.3.20 allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys...

PT-2025-35307

Name of the Vulnerable Software and Affected Versions: Evope Core version 1.1.3.20 Description: An issue allows a local attacker to obtain sensitive information via the use of hard coded cryptographic keys. Recommendations: At the moment, there is no information about a newer version that contain...

CVE-2024-46917

The CVE-2024-46917 entry concerns Diebold Nixdorf Vynamic Security Suite up to version 4.3.0 SR01. The vulnerability arises because integrity validation does not validate file attributes or the contents of the /root directory, enabling malicious actions. Reported impact includes code execution, r...

Brute-force Attack

jwe is vulnerable to Brute-force Attack. The vulnerability is due to insufficient validation of JWE authentication tags, which allows an attacker to brute force tags, recover the GCM GHASH key, and craft arbitrary JWEs leading to loss of confidentiality...

We Are Still Unable to Secure LLMs from Malicious Inputs

Nice indirect prompt injection attack: Bargury's attack starts with a poisoned document, which is shared to a potential victim's Google Drive. Bargury says a victim could have also uploaded a compromised file to their own account. It looks like an official document on company meeting policies. Bu...

Salesloft OAuth Breach via Drift AI Chat Agent Exposes Salesforce Customer Data

A widespread data theft campaign has allowed hackers to breach sales automation platform Salesloft to steal OAuth and refresh tokens associated with the Drift artificial intelligence AI chat agent. The activity, assessed to be opportunistic in nature, has been attributed to a threat actor tracked...

Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in cryptography-44.0.0-cp37-abi3-macosx_10_9_universal2.whl

Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of cryptography-44.0.0-cp37-abi3-macosx109universal2.whl Vulnerability Details CVEID:CVE-2024-12797 DESCRIPTION: Issue summary: Clients using RFC7250 Raw Public Keys RPKs to authenticate a server may fail to notice that the...

Embeded Malicious Code

Overview @nx/workspace is an AI-first build platform that connects everything from your editor to CI. Helping you deliver fast, without breaking things. Affected versions of this package are vulnerable to Embeded Malicious Code through a malicious postinstall script that triggers a file named...

Embeded Malicious Code

Overview @nx/devkit is an AI-first build platform that connects everything from your editor to CI. Helping you deliver fast, without breaking things. This package contains a set of utilities for creating Nx plugins. Affected versions of this package are vulnerable to Embeded Malicious Code throug...

Linux Distros Unpatched Vulnerability : CVE-2025-43926

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Znuny through 6.5.14 and 7.x through 7.1.6. Custom AJAX calls to the AgentPreferences UpdateAJAX subaction can be used to set user...

Linux Distros Unpatched Vulnerability : CVE-2019-11873

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wolfSSL 4.0.0 has a Buffer Overflow in DoPreSharedKeys in tls13.c when a current identity size is greater than a client identity size. An attacker sends a craft...

Craft CMS 4.x < 4.13.8 / 5.x < 5.5.8 RCE (GHSA-x684-96hh-833x)

The version of Craft CMS installed on the remote host is 4.x prior to 4.13.8 or 5.x prior to 5.5.8. It is, therefore, affected by a remote code execution vulnerability: - A remote code execution RCE vulnerability affects Craft 4 and 5 installs where your security key has already been compromised...

Linux Distros Unpatched Vulnerability : CVE-2024-9623

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in GitLab CE/EE affecting all versions starting from 8.16 prior to 17.2.9, starting from 17.3 prior to 17.3.5, and starting from 17.4...

Linux Distros Unpatched Vulnerability : CVE-2020-28498

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm th...

Linux Distros Unpatched Vulnerability : CVE-2023-3509

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue has been discovered in GitLab affecting all versions before 16.7.6, all versions starting from 16.8 before 16.8.3, all versions starting from 16.9 befo...

Linux Distros Unpatched Vulnerability : CVE-2020-15309

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in wolfSSL before 4.5.0, when single precision is not employed. Local attackers can conduct a cache-timing attack against public key...

Linux Distros Unpatched Vulnerability : CVE-2021-21440

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Generated Support Bundles contains private S/MIME and PGP keys if containing folder is not hidden. This issue affects: OTRS AG OTRS Community Edition 6.0.x...

Linux Distros Unpatched Vulnerability : CVE-2020-35861

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the bumpalo crate before 3.2.1 for Rust. The realloc feature allows the reading of unknown memory. Attackers can potentially read...