MAL-2025-1279 Malicious code in probit-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b90c84ef211f2f9ce83ee001f131dc0beaf0a6c6bf8667374fb9f14e54ae6fe3 Any computer that has this package install...

MAL-2025-1274 Malicious code in toobit-main (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bbef733acdf5215bfdef9bb31af40ec7e1bd2fb0cab3167cf10876e9020e971e Any computer that has this package install...

Astra Linux – Vulnerability in Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: nfsd: returns -EINVAL when namelen is 0 When we have a corrupted main.sqlite file in /var/lib/nfs/nfsdcld/, it may result in namelen being 0, which will cause memdupuser to return ZEROSIZEPTR. When we access the name.data that ha...

The vulnerability of the ScadaServer/ScadaServer/ScadaServerEngine/MainLogic.cs file in the SCADA system for developing automation control systems. This vulnerability allows a perpetrator to compromise the integrity of protected information.

The vulnerability of the ScadaServer/ScadaServer/ScadaServerEngine/MainLogic.cs file in SCADA systems for the development of automation systems is related to weak password requirements. Exploiting this vulnerability could allow a malicious actor to compromise the integrity of protected informatio...

The vulnerability of the hnap_main function in the D-LINK GO-RT-AC750 router’s software allows a hacker to execute arbitrary commands.

The vulnerability of the hnapmain function in the D-LINK GO-RT-AC750 router’s microprogramming software is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows a remote attacker to execute arbitrary comman...

PT-2025-3194 · Zulip · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip Server versions 7.0 through 9.3 Description: The issue concerns an information disclosure attack where an unauthenticated user can determine if an email address is in use by a user on a Zulip server hosting multiple organizations. There...

The vulnerability of the hnap_main() function in D-LINK DIR-806 wireless router software allows a hacker to execute arbitrary commands, gain unauthorized access to protected information, or cause service failures.

The vulnerability of the hnapmain function in D-LINK DIR-806 wireless routers is related to the lack of measures taken to neutralize special elements used in the operating system commands. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely, gain unauthorized...

XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

Impact Any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document Scheduler.WebHome in a subwiki. Then, click on any operation e.g., Trigger on any job. If the operation is successful...

GHSA-CWQ6-MJMX-47P6 XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

Impact Any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document Scheduler.WebHome in a subwiki. Then, click on any operation e.g., Trigger on any job. If the operation is successful...

CVE-2024-55876 XWiki's scheduler in subwiki allows scheduling operations for any main wiki user

XWiki Platform is a generic wiki platform. Starting in version 1.2-milestone-2 and prior to versions 15.10.9 and 16.3.0, any user with an account on the main wiki could run scheduling operations on subwikis. To reproduce, as a user on the main wiki without any special right, view the document...

PT-2024-36595 · Xwiki · Xwiki Platform

Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 1.2-milestone-2 through 15.10.8 XWiki Platform versions 1.2-milestone-2 through 16.2.x Description: The issue allows any user with an account on the main wiki to run scheduling operations on subwikis. To reproduce, a...

path-to-regexp: Backtracking regular expressions cause ReDoS

A flaw was found in path-to-regexp package, where it turns path strings into regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single-threaded and regex matching runs on the main thread, po...

Malicious code in my-main-manager (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ac004ff76ebc011d60ae86c56b7f57ddb6ac0d24ff0ddd9ad777319775f79282 While the package appears to be a manager for Windows service, the linked executable is an infostealer with capabilities like cookie stealing ang keylogger. Th...

CVE-2017-13319

In pvmp3getmaindatasize of pvmp3getmaindatasize.cpp, there is a possible buffer overread due to a missing bounds check. This could lead to remote information disclosure of global static variables with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2024-36248

CVE-2024-36248 affects Sharp MFPs and related devices, where API keys for cloud services are hardcoded in the main binary. This root cause can enable exposure or misuse of cloud credentials by anyone gaining access to the device, potentially allowing unauthorized external access or data exposure ...

CVE-2024-36248

API keys for some cloud services are hardcoded in the "main" binary. As for the details of affected product names, model numbers, and versions, refer to the information provided by the respective vendors listed under References...

PT-2024-26930 · Sharp +1 · Multiple Mfps

Name of the Vulnerable Software and Affected Versions: No specific software name or affected versions are mentioned in the provided descriptions. Description: The issue involves hardcoded API keys for some cloud services in the "main" binary, posing security risks. The details of affected product...

The vulnerability in the bridge_wireless_main.cgi script of NETGEAR XR300 router software allows a hacker to induce a service failure.

The vulnerability in the bridgewirelessmain.cgi script of NETGEAR XR300 router software is related to buffer overflows in the stack when processing the parameter ssidan. Exploiting this vulnerability allows a malicious actor to trigger a Denial-of-Service attack by sending a specially crafted POS...

The vulnerability in the bridge_wireless_main.cgi script of the Netgear XR300 router’s software allows a hacker to induce a service failure.

The vulnerability in the bridgewirelessmain.cgi script of the Netgear XR300 router software lies in the copying of buffers without checking the size of the input data during the processing of the ssid parameter. Exploiting this vulnerability allows a malicious actor to cause service failure by...

AVSCMS 安全漏洞

AVSCMS is a content management system of AVSCMS open source. A security vulnerability exists in AVSCMS version v8.2.0, which originates from an arbitrary file upload vulnerability in component /main/fileupload.php, which allows an attacker to execute arbitrary code by uploading a carefully crafte...