8126 matches found
GHSA-6PX8-MR29-CJ4R DataChain Vulnerable to Deserialization of Untrusted Data from Environment Variables
The DataChain library reads serialized objects from environment variables such as DATACHAINMETASTORE and DATACHAINWAREHOUSE in the loader.py module. An attacker with the ability to set these environment variables can trigger code execution when the application loads...
CVE-2025-57305
VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp...
CVE-2025-57305
VitaraCharts 5.3.5 is vulnerable to Server-Side Request Forgery in fileLoader.jsp...
CVE-2025-57443
FrostWire 6.14.0-build-326 for macOS contains permissive entitlements allow-dyld-environment-variables, disable-library-validation that allow unprivileged local attackers to inject code into the FrostWire process via the DYLDINSERTLIBRARIES environment variable. This allows escalated privileges t...
PT-2025-40450
Name of the Vulnerable Software and Affected Versions DataChain versions 0.34.1 and below Description DataChain is a Python-based AI-data warehouse for transforming and analyzing unstructured data. The library reads serialized objects from environment variables, specifically DATACHAIN METASTORE a...
CVE-2025-57443
FrostWire 6.14.0-build-326 for macOS contains permissive entitlements allow-dyld-environment-variables, disable-library-validation that allow unprivileged local attackers to inject code into the FrostWire process via the DYLDINSERTLIBRARIES environment variable. This allows escalated privileges t...
Fuji Electric FRENIC-Loader 4 EXRTM File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric FRENIC-Loader 4. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
Fuji Electric FRENIC-Loader 4 EXTBM File Parsing Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Fuji Electric FRENIC-Loader 4. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...
ROS-20250930-04
The Open Asset Import Library Assimp 3D model import library implementation vulnerability is related to manipulation of the skinwidth/skinheight argument. Exploitation of the vulnerability could allow an attacker to cause a denial of service Vulnerability in Open Asset Import Library Assimp 3D...
Malicious code in zenith.svg-loader (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f7d2ffc7aca71791695515d2f4c7d4cd7dae2e7767777a5a18bed84f9d94e7f Any computer that has this package installed or running should be considered...
MAL-2025-47866 Malicious code in zenith.svg-loader (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f7d2ffc7aca71791695515d2f4c7d4cd7dae2e7767777a5a18bed84f9d94e7f Any computer that has this package installed or running should be considered...
CVE-2025-11013
A vulnerability was identified in BehaviorTree up to 4.7.0. This vulnerability affects the function XMLParser::PImpl::loadDocImpl of the file /src/xmlparsing.cpp of the component XML Parser. The manipulation leads to null pointer dereference. The attack can only be performed from a local...
Grub2 Data Compromise Breach
The vulnerability of Grub2 operating system loaders is related to the violation of trust boundaries. Exploiting this vulnerability can allow an attacker to disclose confidential information...
CVE-2025-59402
Flock Safety Bravo Edge AI Compute Device BRAVO00.00local20241017 accepts the default Thundercomm TurboX 6490 Firehose loader in EDL/QDL mode. This enables attackers with physical access to flash arbitrary firmware, dump partitions, and bypass bootloader and OS security controls...
CLSA-2025-1758825546 gimp: Fix of CVE-2025-48798
CVE-2025-48798: fix XCF loader use-after-free issues by properly managing layer/channel resources and ensuring safe cleanup during parsing...
Malicious Package
Overview envs-loader is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
Malware in envs-loader
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
MAL-2025-47553 Malicious code in envs-loader (npm)
The package envs-loader was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94802ccdee601e77ff6361593b03ef5b414dec7eaeccd58d8ed6b2305886b27d Any computer that has this package installed or running should be considered fully...
Malicious code in envs-loader (npm)
The package envs-loader was found to contain malicious code. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94802ccdee601e77ff6361593b03ef5b414dec7eaeccd58d8ed6b2305886b27d Any computer that has this package installed or running should be considered fully...
commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default
A flaw was found in Apache Commons BeanUtils. This vulnerability allows remote attackers to execute arbitrary code via uncontrolled access to the declaredClass property on Java enum objects, which can expose the class loader when property paths are passed from external sources to methods like...