15027 matches found
Researchers Report 84 Flaws in 4G and 5G Cores, Including a Session Hijacking Flaw
An academic study has disclosed a "widespread class" of security vulnerabilities impacting 4G and 5G core networks that, if successfully exploited, could trigger denial-of-service DoS attacks and even session hijacking, allowing an attacker to seize control of a user's network session. The findin...
Network Anomaly Detection in KATA
Introduction Once the attacker has breached the corporate network, subsequent stages of the attack often involve leveraging standard domain infrastructure protocols: using Kerberos, running DNS queries, accessing internal services, opening network shares, and other common networking actions...
Citrix StoreFront - Cross-Site Scripting
Reflected Cross-Site Scripting issue which is exploitable without authentication. This vulnerability was exploitable through coercing an error message during an XML parsing procedure in the SSO flow. id: CVE-2023-5914 info: name: Citrix StoreFront - Cross-Site Scripting author: DhiyaneshDK...
Redash Setup Configuration - Default Secrets Disclosure
Redash Setup Configuration is vulnerable to default secrets disclosure Insecure Default Initialization of Resource. If an admin sets up Redash versions =10.0 and prior without explicitly specifying the REDASHCOOKIESECRET or REDASHSECRETKEY environment variables, a default value is used for both...
Security Bulletin: IBM Maximo Application Suite - Monitor Component uses multiple dependencies which are vulnerable to multiple CVEs.
Summary IBM Maximo Application Suite - Monitor Component uses yaml-2.6.1.tgz, log4j-api-2.24.3.jar, onnx-1.21.0-cp311-cp311-manylinux227x8664.manylinux228x8664.whl, spring-boot-autoconfigure-3.5.14.jar, spring-web-6.2.18.jar, dompurify-3.3.3.tgz, netty-codec-http-4.2.12.Final.jar, qs-6.14.2.tgz,...
Security Bulletin: The Pulse App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities
Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Pulse App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2025-15284 DESCRIPTION: Improper Input Validation...
Exploit for Double Free in Linux Linux_Kernel
Huawei P10 CVE-2017-8890 bootloader-unlock research This repo...
Security Bulletin: Multiple Vulnerabilities in IBM Concert Operate / IBM Cloud Pak for AIOps
Summary Multiple vulnerabilities were addressed in IBM Concert Operate version 5.1.5 Vulnerability Details CVEID:CVE-2025-15366 DESCRIPTION: The imaplib module, when passed a user-controlled command, can have additional commands injected using newlines. Mitigation rejects commands containing...
Hackers Exploit AnySign4PC via Hacked Korean Sites to Install Backdoors Without Prompts
South Korean authorities and four security firms have disclosed a state-sponsored campaign that compromised trusted domestic websites. The attackers used those sites to exploit locally installed financial-security software and infect targeted visitors with SIGNBT or COPPERHEDGE backdoors. A...
K000162286: BIND vulnerability CVE-2026-1519
Security Advisory Description If a BIND resolver is performing DNSSEC validation and encounters a maliciously crafted zone, the resolver may consume excessive CPU. Authoritative-only servers are generally unaffected, although there are circumstances where authoritative servers may make recursive...
CVE-2026-54666
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...
GHSA-W284-33MX-6G9V swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
Summary swagger-typescript-api interpolates OpenAPI path strings the keys of the paths object, e.g. /users/id directly into a JavaScript template literal inside the body of every generated API method, without escaping. A spec path containing $ … survives parseRouteName's x / :x rewriter verbatim...
swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
Summary swagger-typescript-api interpolates OpenAPI path strings the keys of the paths object, e.g. /users/id directly into a JavaScript template literal inside the body of every generated API method, without escaping. A spec path containing $ … survives parseRouteName's x / :x rewriter verbatim...
CVE-2026-54666
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...
CVE-2026-54666 swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...
CVE-2026-54666 swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...
CVE-2026-54666
swagger-typescript-api contains a code-injection risk in generated API clients prior to 13.12.2. OpenAPI path keys are passed through parseRouteName into template code without escaping template literals, causing attacker-controlled paths containing ${...} to be evaluated when a generated method r...
EUVD-2026-50367
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...
CVE-2026-54666 swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies
swagger-typescript-api generates API clients for Fetch or Axios from an OpenAPI Specification. Prior to 13.12.2, src/schema-routes/schema-routes.ts passes OpenAPI path keys through parseRouteName to templates/default/procedure-call.ejs and templates/modular/procedure-call.ejs without escaping...