4609 matches found
EUVD-2024-48174
Malicious code in bioql PyPI...
EUVD-2022-4450
Malicious code in bioql PyPI...
CVE-2025-59686
Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id...
CVE-2025-59686
Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id...
CVE-2025-59686
Kazaar 1.25.12 allows /api/v1/org-id/orders/order-id/documents calls with a modified order-id...
PT-2025-40252
Name of the Vulnerable Software and Affected Versions Kazaar version 1.25.12 Description The software allows calls to /api/v1/org-id/orders/order-id/documents with a modified order-id. This could potentially lead to unauthorized access or manipulation of data. Recommendations Apply any available...
CVE-2025-59686
Kazaar 1.25.12 has a vulnerability in the API endpoint /api/v1/org-id/orders/order-id/documents where a modified order-id allows an insecure direct object reference. Root cause: manipulation of the order-id parameter. Impact: potential unauthorized access or data manipulation for orders. Exploita...
CVE-2025-42907
SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system...
CVE-2025-59408
The CVE-2025-59408 entry refers to Flock Safety Bravo Edge AI Compute Device BRAVO_00.00_local_20241017 with Secure Boot disabled, enabling modification of firmware without cryptographic protections. The NVD/NVD-derived descriptions confirm the device can be flashed with modified firmware due to ...
Remote Code Execution (RCE)
picklescan is vulnerable to Remote Code Execution RCE. The vulnerability is due to unsafe execution/deserialization because idlelib.pyshell.ModifiedInterpreter.runcode can execute untrusted code e.g., from malicious pickle data in the interpreter context...
CVE-2025-42907
SAP BI Platform allows an attacker to modify the IP address of the LogonToken for the OpenDoc. On accessing the modified link in the browser a different server could get the ping request. This has low impact on integrity with no impact on confidentiality and availability of the system...
CVE-2025-9627
The Run Log plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7.10. This is due to missing or incorrect nonce validation on the oirlpluginoptions function. This makes it possible for unauthenticated attackers to modify plugin settings includi...
GHSA-J343-8V2J-FF7W Picklescan is missing detection when calling built-in python idlelib.pyshell.ModifiedInterpreter.runcommand
Summary Using idlelib.pyshell.ModifiedInterpreter.runcommand function, which is a built-in python library function to execute remote pickle file. Details The attack payload executes in the following steps: First, the attacker craft the payload by calling to...
Malicious Package
Overview bittenso is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a typosquatting campaign targeting the Bittensor ecosystem. The goal of the attackers is to steal cryptocurrency from...
Malicious Package
Overview bittenso-cli is a malicious package. This package contains malicious code, and its content was removed from the official package manager. The package appears to be part of a typosquatting campaign targeting the Bittensor ecosystem. The goal of the attackers is to steal cryptocurrency fro...
WordPress WP Last Modified Info plugin <= 1.9.4 - Remote Code Execution (RCE) vulnerability
Remote Code Execution RCE vulnerability discovered by zaim in WordPress Plugin WP Last Modified Info versions = 1.9.4...
Linux Distros Unpatched Vulnerability : CVE-2018-19141
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Open Ticket Request System OTRS 4.0.x before 4.0.33 and 5.0.x before 5.0.31 allows an admin to conduct an XSS attack via a modified URL because user and custome...
UBUNTU-CVE-2025-38337
In the Linux kernel, the following vulnerability has been resolved: jbd2: fix data-race and null-ptr-deref in jbd2journaldirtymetadata Since handle-htransaction may be a NULL pointer, so we should change it to call ishandleabortedhandle first before dereferencing it. And the following data-race w...
Fedora: Security Advisory (FEDORA-2025-f2525743d6)
The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...