Malicious code in airbnb-location-suggester (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2737604ff441534b7aeae22ee55636471142cccc2d6e2bbd4895a8f640c30aa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5488 Malicious code in airbnb-location-suggester (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2737604ff441534b7aeae22ee55636471142cccc2d6e2bbd4895a8f640c30aa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests

A vulnerability was found in modproxycluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in...

PT-2025-30928 · Tableau · Tableau Server

Name of the Vulnerable Software and Affected Versions: Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description: Tableau Server is susceptible to a Server-Side Request Forgery SSRF issue within the EPS Server modul...

PT-2025-30926 · Tableau · Tableau Server

Name of the Vulnerable Software and Affected Versions: Tableau Server versions prior to 2025.1.3 Tableau Server versions prior to 2024.2.12 Tableau Server versions prior to 2023.3.19 Description: A Server-Side Request Forgery SSRF vulnerability exists in Tableau Server on Windows and Linux Flow...

mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests

A vulnerability was found in modproxycluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in...

mod_proxy_cluster: mod_proxy_cluster unauthorized MCMP requests

A vulnerability was found in modproxycluster. The issue is that the directive should be replaced by the directive as the former does not restrict IP/host access as Require ip IPADDRESS would suggest. This means that anyone with access to the host might send MCMP requests that may result in...

Versatile and Fast Location-Based Private Information Retrieval with Fully Homomorphic Encryption over the Torus

Location-based services often require users to share sensitive locational data, raising privacy concerns due to potential misuse or exploitation by untrusted servers. In response, we present VeLoPIR, a versatile location-based private information retrieval PIR system designed to preserve user...

Fuzzy Location and Allocation Hub Network Design for Air Cargo Transportation Considering Sustainability and Time Window

Hub location Problems seek to find hub facilities and assign non-hub nodes to them in such a way that the flow between origin and destination should be effectively established according to the desired goal. In general, in the literature of location, it is assumed that the time horizon of hub...

Buy It Now, Track Me Later: Attacking User Privacy Via Wi-Fi AP Online Auctions

Static and hard-coded layer-two network identifiers are well known to present security vulnerabilities and endanger user privacy. In this work, we introduce a new privacy attack against Wi-Fi access points listed on secondhand marketplaces. Specifically, we demonstrate the ability to remotely...

Zero-Knowledge Proof-Of-Location Protocols for Vehicle Subsidies and Taxation Compliance

This paper introduces a new set of privacy-preserving mechanisms for verifying compliance with location-based policies for vehicle taxation, or for electric vehicle EV subsidies, using Zero-Knowledge Proofs ZKPs. We present the design and evaluation of a Zero-Knowledge Proof-of-Location ZK-PoL...

Directory Traversal

Overview DotVVM is an open source ASP.NET-based framework which allows to build interactive web apps easily by using mostly C and HTML. Affected versions of this package are vulnerable to Directory Traversal via the FileResourceLocation process in Debug mode. An attacker can access sensitive file...

Astra Linux – Vulnerability in PHP 8.2

In PHP versions starting from 8.1. up to 8.1.32, and from 8.2. up to 8.2.28, and from 8.3. up to 8.3.19, as well as in PHP versions starting from 8.4. up to 8.4.5, there is a limitation on the size of the location parameter due to the limited size of the location buffer, which is set to 1024...

Astra Linux – Vulnerability in Linux 6.12

In the Linux kernel, the following vulnerabilities have been resolved: drm/amd/display: Fixed out-of-bound accesses WHAT & HOW hpostreamtolinkencodermapping has a size of MAXHPODP2ENCODERS =4, but its location can be up to 6 in size. As a result, it is necessary to check the location against...

[SECURITY] Fedora 42 Update: qt6-qtlocation-6.9.1-1.fc42

The Qt Location API helps you create viable mapping solutions using the data available from some of the popular location services...

Microsoft Windows Installer Service Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Windows...

External Control of File Name or Path

Overview elmsln/haxcms is a Headless CMS for managing and publishing hybrid static, web component driven sites. Affected versions of this package are vulnerable to External Control of File Name or Path via the location parameter in the saveOutline API endpoint. An attacker can read arbitrary file...

HAX CMS vulnerable to Local File Inclusion via saveOutline API Location Parameter

Summary An authenticated Local File Inclusion LFI vulnerability in the HAXCMS saveOutline endpoint allows a low-privileged user to read arbitrary files on the server by manipulating the location field written into site.json. This enables attackers to exfiltrate sensitive system files such as...

CVE-2025-5480

Action1 Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Action1. An attacker must first obtain the ability to execute low-privileged code on the target system in order to explo...

FasterXML jackson-core 安全漏洞

FasterXML jackson-core is a FasterXML open source API software. A security vulnerability exists in FasterXML jackson-core versions prior to 2.13.0, which stems from an issue with the JsonLocation.appendSourceDesc method that could lead to information disclosure...