EUVD-2025-0184

Malicious code in bioql PyPI...

CVE-2024-49364

CVE-2024-49364 affects tiny-secp256k1 (NPM wrapper). Prior to 1.1.7, if global Buffer comes from the NPM buffer package, the Buffer.isBuffer check can be bypassed, enabling private key extraction by signing a malicious JSON-stringifiable object via key reuse across messages. The issue is fixed in...

tiny-secp256k1 allows for verify() bypass when running in bundled environment

Summary A malicious JSON-stringifyable message can be made passing on verify, when global Buffer is buffer package Details This affects only environments where require'buffer' is E.g.: browser bundles, React Native apps, etc. Buffer.isBuffer check can be bypassed, resulting in strange objects bei...

CVE-2024-27800

This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. Processing a maliciously crafted message may lead to a...

CVE-2023-21339

In Minikin, there is a possible way to trigger ANR by showing a malicious message due to resource exhaustion. This could lead to remote denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

Linux Distros Unpatched Vulnerability : CVE-2022-46149

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Cap'n Proto is a data interchange format and remote procedure call RPC system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as version...

CVE-2024-57392

Buffer Overflow vulnerability in Proftpd commit 4017eff8 allows a remote attacker to execute arbitrary code and can cause a Denial of Service DoS on the FTP service by sending a maliciously crafted message to the ProFTPD service port...

GHSA-Q26P-9CQ4-7FC2 Go Ethereum vulnerable to DoS via malicious p2p message

Impact A vulnerable node can be forced to shutdown/crash using a specially crafted message. During the peer-to-peer connection handshake, a shared secret key is computed. The implementation did not verify whether the EC public key provided by the remote party is a valid point on the secp256k1...

CVE-2025-24883

CVE-2025-24883 affects the Go Ethereum client (go-ethereum). A node can be forced offline or crash by processing a specially crafted P2P message, constituting a DoS condition. The CVE is linked to the Go Ethereum project (GO-2025-3436) describing a DoS via malicious P2P messages in github.com/eth...

CVE-2025-24883 go-ethereum has a DoS via malicious p2p message

go-ethereum geth is a golang execution layer implementation of the Ethereum protocol. A vulnerable node can be forced to shutdown/crash using a specially crafted message. This vulnerability is fixed in 1.14.13...

CVE-2024-52324

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands...

Ruijie Networks ReyeeOS 安全漏洞

Ruijie Networks ReyeeOS is a router from Ruijie Networks China. A security vulnerability exists in Ruijie Networks ReyeeOS version 2.206.x up to and including version 2.320.x. An attacker can use this vulnerability to send a malicious message. An attacker could use this vulnerability to send a...

CVE-2024-44297

The issue was addressed with improved bounds checks. This issue is fixed in tvOS 18.1, iOS 18.1 and iPadOS 18.1, iOS 17.7.1 and iPadOS 17.7.1, macOS Ventura 13.7.1, macOS Sonoma 14.7.1, watchOS 11.1, visionOS 2.1. Processing a maliciously crafted message may lead to a denial-of-service...

PT-2024-31120 · Apple · Macos Sonoma +7

Name of the Vulnerable Software and Affected Versions: Apple iOS versions prior to 18.1 Apple iOS versions prior to 17.7.1 Apple iPadOS versions prior to 18.1 Apple iPadOS versions prior to 17.7.1 Apple macOS Ventura versions prior to 13.7.1 Apple macOS Sonoma versions prior to 14.7.1 Apple tvOS...

GO-2022-0456 DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereum

DoS via malicious p2p message in Go Ethereum in github.com/ethereum/go-ethereum...

CVE-2023-20513

An insufficient bounds check in PMFW Power Management Firmware may allow an attacker to utilize a malicious VF virtualization function to send a malformed message, potentially resulting in a denial of service...

CVE-2024-5988

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™...

CVE-2024-5988

Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a remote code execution condition on the Rockwell Automation ThinManager® ThinServer™...

PT-2024-37296 · Rockwell Automation · Rockwell Automation Thinserver

Name of the Vulnerable Software and Affected Versions: Rockwell Automation ThinServer affected versions not specified Description: The issue is caused by improper input validation, allowing an unauthenticated threat actor to send a malicious message to a monitor thread and cause a denial-of-servi...

Rockwell Automation ThinServer 安全漏洞

Rockwell Automation ThinManager is a thin client management software from Rockwell Automation, Inc. It allows thin clients to be assigned to multiple remote desktop servers simultaneously. An input validation error vulnerability exists in Rockwell Automation ThinManager ThinServer, which can be...