59 matches found
CVE-2026-0096
In getAppLabel of ForgetDeviceDialogFragment.java, there is a possible trick the user into forgetting a device due to misleading or insufficient UI. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...
PT-2026-39318
Name of the Vulnerable Software and Affected Versions Gibbon versions prior to v30.0.01 Description A local file inclusion issue allows remote code execution by modifying the report archive directory and forcing the system to interpret a user-provided .zip file as PHP. This requires Teacher or...
CVE-2026-33249
A flaw was found in NATS-Server. A valid client can exploit this flaw by manipulating message tracing headers to redirect trace messages to any valid subject, even those for which the client lacks publish permissions. This allows for unauthorized sending of trace messages, potentially bypassing...
CVE-2026-1658 Content spoofing vulnerability discovered in OpenText™ Directory Services
User Interface UI Misrepresentation of Critical Information vulnerability in OpenText™ Directory Services allows Cache Poisoning. The vulnerability could be exploited by a bad actor to inject manipulated text into the OpenText application, potentially misleading users. This issue affects Director...
Silver Fox Uses Fake Microsoft Teams Installer to Spread ValleyRAT Malware in China
The threat actor known as Silver Fox has been spotted orchestrating a false flag operation to mimic a Russian threat group in attacks targeting organizations in China. The search engine optimization SEO poisoning campaign leverages Microsoft Teams lures to trick unsuspecting users into downloadin...
GHSA-JJ37-3377-M6VV Duplicate Advisory: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-mm7p-fcc7-pg87. This link is maintained to preserve external references. Original Description A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient...
CVE-2025-13033 Nodemailer: nodemailer: email to an unintended domain can occur due to interpretation conflict
A vulnerability was identified in the email parsing library due to improper handling of specially formatted recipient email addresses. An attacker can exploit this flaw by crafting a recipient address that embeds an external address within quotes. This causes the application to misdirect the emai...
Nodemailer 安全漏洞
Nodemailer is a JS codebase from the Nodemailer team that uses a JS codebase that provides the ability to send emails. A security vulnerability exists in Nodemailer that stems from mishandling of the email parsing library, which could result in emails being misdirected to an attacker's address,...
EUVD-2020-4109
Malware in sbrugna...
EUVD-2020-27356
Malware in sbrugna...
EUVD-2021-33444
Malicious code in bioql PyPI...
EUVD-2024-16029
Malicious code in bioql PyPI...
EUVD-2023-45842
Malicious code in bioql PyPI...
EUVD-2022-25394
Malicious code in bioql PyPI...
EUVD-2023-25184
Malicious code in bioql PyPI...
Linux Distros Unpatched Vulnerability : CVE-2023-41337
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or...
Linux Distros Unpatched Vulnerability : CVE-2024-0231
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft ...
WordPress plugin Structured Content 跨站脚本漏洞
WordPress structured content is a technology that improves search result display and click-through rates by optimizing semantic markup of web page elements e.g., titles, descriptions, images, etc. to enhance search engine understanding of page content. A cross-site scripting vulnerability exists ...
CVE-2024-0231
A resource misdirection vulnerability in GitLab CE/EE versions 12.0 prior to 17.0.5, 17.1 prior to 17.1.3, and 17.2 prior to 17.2.1 allows an attacker to craft a repository import in such a way as to misdirect commits...
CVE-2023-41337
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the...