137 matches found
Remember, remember the fifth of November
Welcome to this week's edition of the Threat Source newsletter. Ever heard the phrase in this week's title? For our non-British readers, here's the quick version: Every year on November 5, people across the U.K. gather for bonfires, sparklers, fireworks, and attempting to literally handle a hot...
EUVD-2024-40422
Malicious code in bioql PyPI...
EUVD-2024-48660
Malicious code in bioql PyPI...
EUVD-2022-7761
Malicious code in bioql PyPI...
Robust DDoS-Attack Classification with 3D CNNs against Adversarial Methods
Distributed Denial-of-Service DDoS attacks remain a serious threat to online infrastructure, often bypassing detection by altering traffic in subtle ways. We present a method using hive-plot sequences of network data and a 3D convolutional neural network 3D CNN to classify DDoS traffic with high...
index.php Arbitrary Command Execution
The vulnerability of the index.php script used by the sar2html system statistics visualization tool is related to insufficient validation of input data during the processing of the plot parameter. Exploiting this vulnerability allows an attacker to execute arbitrary commands remotely...
CVE-2025-34030 sar2html OS Command Injection
An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to t...
CVE-2025-34030 sar2html OS Command Injection
An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to t...
CVE-2025-34030: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to t...
sar2html security vulnerability
sar2html is an icon generation software by cemtan individual developer. A security vulnerability exists in sar2html 3.2.2 and earlier versions, which stems from not cleaning up the plot parameter and could lead to an OS command injection attack...
VulnCheck KEV: CVE-2025-34030
An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. The application fails to sanitize user-supplied input before using it in a system-level context. Remote, unauthenticated attackers can inject shell commands by appending them to t...
CVE-2023-46308
In Plotly plotly.js before 2.25.2, plot API calls have a risk of proto being polluted in expandObjectPaths or nestedProperty...
CVE-2022-46682
Jenkins Plot Plugin 2.1.11 and earlier does not configure its XML parser to prevent XML external entity XXE attacks...
CVE-2022-34783
Jenkins Plot Plugin 2.1.10 and earlier does not escape plot descriptions, resulting in a stored cross-site scripting XSS vulnerability exploitable by attackers with Item/Configure permission...
GNUPlot code-related vulnerabilities
gnuplot is a command line interactive tool by Leon Sorokin, a personal developer, that allows users to convert data and data functions into easy-to-see planar or three-dimensional shapes by entering commands. A code issue vulnerability exists in gnuplot that stems from the plot3dpoints function...
The Trial at the Tip of the Terrorgram Iceberg
Atomwaffen Division cofounder and alleged Terrorgram Collective member Brandon Russell is facing a potential 20-year sentence for an alleged plot on a Baltimore electrical station. His case is only the beginning...
CVE-2024-7801
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Microchip TimeProvider 4100 Data plot modules allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7...
CVE-2024-7801
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Microchip TimeProvider 4100 Data plot modules allows SQL Injection.This issue affects TimeProvider 4100: from 1.0 before 2.4.7...
CVE-2024-43686
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Microchip TimeProvider 4100 data plot modules allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7...
CVE-2024-43686
CVE-2024-43686 affects Microchip TimeProvider 4100 data plot modules. Vulnerable in TimeProvider 4100 versions 1.0 through before 2.4.7; condition is improper neutralization of input during web page generation, resulting in reflected XSS. Connected sources specify an affected product scope and th...