5059 matches found
CVE-2025-66911
Turms IM Server v0.10.0-SNAPSHOT and earlier contains a broken access control vulnerability in the user online status query functionality. The handleQueryUserOnlineStatusesRequest method in UserServiceController.java allows any authenticated user to query the online status, device information, an...
turms 安全漏洞
turms is an instant messaging engine from turms-im open source. A security vulnerability exists in turms AI-Serving module v0.10.0-SNAPSHOT and prior versions, which originates from an image decompression bomb and may result in a denial of service...
CVE-2025-66911
Turms IM Server prior to 0.10.0-SNAPSHOT is affected by a broken access control vulnerability in the user online status query function. The handleQueryUserOnlineStatusesRequest() in UserServiceController.java lets any authenticated user query the online status, device information, and login times...
turms 安全漏洞
turms is an instant messaging engine from turms-im open source. A security vulnerability exists in turms v0.10.0-SNAPSHOT and prior versions, which stems from cross-site request forgery and could lead to elevation of privilege...
CVE-2025-68263
In CVE-2025-68263, the Linux kernel ksmbd IPC path had a use-after-free in ipc_msg_send_request caused by freeing entry->response without holding ipc_msg_table_lock while handle_response() can still write to it. The race occurs under high concurrency when handle_response() copies to entry->...
exordos-core (>=0.0.7 <=0.1.1), genesis-core (>=0.0.2 <=0.0.6) +3 more potentially affected by CVE-2025-68113 via altcha (=0.2.0)
altcha PYPI version =0.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on altcha and may be impacted: - exordos-core =0.0.7, =0.0.2, =5.11.0, =0.1.0, =0.12.0 - wlhosted =2024.11.0 Source cves: CVE-2025-68113 Source advisory: OSV:GHSA-6GVQ-JCMP-8959...
CVE-2025-59923
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the...
📄 Chromodo Browser 45.8.12.391 Same Origin Policy Weakness
This proof of concept demonstrates message passing between two browser windows when opened under the same logical context same origin. It affect Chromodo Browser version 45.8.12.391...
CVE-2025-59923
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the...
CVE-2025-59923
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the...
CVE-2025-59923
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the...
EUVD-2025-202277
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.4, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the...
CVE-2025-59923
Fortinet FortiAuthenticator is affected by an improper access control vulnerability (CVE-2025-59923). Affected versions include FortiAuthenticator 6.6.0–6.6.6, and 6.5, 6.4, 6.3 all versions. The issue allows an authenticated attacker with at least read-only admin privileges to obtain the credent...
CVE-2023-53825
CVE-2023-53825 affects the Linux kernel’s kcm_sendmsg() for SOCK_DGRAM. A memory-leak in the error path could corrupt the MSG_MORE queue when a partial copy occurs; the fix updates kcm_tx_msg(head)->last_skb and adds purge behavior on failure (like UDP via udp_flush_pending_frames) to avoid qu...
PT-2025-50122
An improper access control vulnerability in Fortinet FortiAuthenticator 6.6.0 through 6.6.6, FortiAuthenticator 6.5 all versions, FortiAuthenticator 6.4 all versions, FortiAuthenticator 6.3 all versions may allow an authenticated attacker with at least read-only admin permission to obtain the...
‘Signalgate’ Inspector General Report Wants Just One Change to Avoid a Repeat Debacle
The United States Inspector General report reviewing Secretary of Defense Pete Hegseth’s text messaging mess recommends a single change to keep classified material secure...
India Orders Messaging Apps to Work Only With Active SIM Cards to Prevent Fraud and Misuse
India's Department of Telecommunications DoT has issued directions to app-based communication service providers to ensure that the platforms cannot be used without an active SIM card linked to the user's mobile number. To that end, messaging apps like WhatsApp, Telegram, Snapchat, Arattai,...
Spyware Allows Cyber Threat Actors to Target Users of Messaging Applications
CISA is aware of multiple cyber threat actors actively leveraging commercial spyware to target users of mobile messaging applications apps.1 These cyber actors use sophisticated targeting and social engineering techniques to deliver spyware and gain unauthorized access to a victim’s messaging app...
Malicious code in airbnb-luxury-messaging (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3721ccc0b94a8795edd99efa6ea640102c705346c6270a7ac203911797eaa7e The package airbnb-luxury-messaging was found to contain malicious code. Source: ossf-package-analysis...