21889 matches found
Inside the Mind of the Attacker: A Conversation with Raj Samani
With Take Command 2025 just around the corner, we sat down with Raj Samani, Chief Scientist at Rapid7, for a preview of his upcoming session: Inside the Mind of an Attacker: Navigating the Threat Horizon. Raj will be joined by Trent Teyema, Founder and President at CSG Strategies and former head ...
CVE-2025-25535
CVE-2025-25535 concerns ScriptCASE (SCRIPT CASE) v1.0.002 Build7, where HTTP response manipulation is reported to allow a remote attacker to escalate privileges via a crafted request. The connected sources consistently attribute the issue to HTTP response manipulation within the ScriptCASE build,...
Scriptcase 安全漏洞
Scriptcase is a low-code platform for rapid application development from Scriptcase, Inc. A security vulnerability exists in Scriptcase version v.1.0.002 Build 7, which stems from HTTP response manipulation and could lead to elevation of privilege...
CVE-2025-25535
HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request...
CVE-2025-25535
HTTP Response Manipulation in SCRIPT CASE v.1.0.002 Build7 allows a remote attacker to escalate privileges via a crafted request...
CYREBRO Recognized in Gartner Emerging Tech Report for Detection and Response Startups
Ramat Gan, Israel, 25th March 2025, CyberNewsWire...
CVE-2025-2744
A vulnerability, which was classified as critical, was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected is an unknown function of the file /admin-api/mp/material/upload-news-image of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. It is...
CVE-2025-2743
A vulnerability, which was classified as problematic, has been found in zhijiantianya ruoyi-vue-pro 2.4.1. This issue affects some unknown processing of the file /admin-api/mp/material/upload-temporary of the component Material Upload Interface. The manipulation of the argument File leads to path...
CVE-2025-2742 zhijiantianya ruoyi-vue-pro Material Upload Interface upload-permanent path traversal
A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. This vulnerability affects unknown code of the file /admin-api/mp/material/upload-permanent of the component Material Upload Interface. The manipulation of the argument File leads to path traversal. The attack...
CVE-2025-2733
CVE-2025-2733 affects mannaandpoem OpenManus up to 2025.3.13. The vulnerability is an OS command injection in the Prompt Handler’s file app/tool/python_execute.py, enabling remote exploitation. Exploitation information is publicly disclosed and the vendor was contacted but did not respond. No rem...
CVE-2025-2729 H3C Magic BE18000 HTTP POST Request networkSetup command injection
A vulnerability was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014 and classified as critical. This issue affects some unknown processing of the file /api/wizard/networkSetup of the component HTTP POST Request Handler. The manipulation leads to...
MAL-2025-2663 Malicious code in datahub-react-web (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1d82378a4b4eeb1355f9d5fbee783eb02ebfd625e5b7480f1ab594461b8d90d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-2727
The CVE-2025-2727 case affects H3C Magic NX30 Pro up to version V100R007. The vulnerability resides in the HTTP POST Request Handler’s /api/wizard/getNetworkStatus function, where an injection flaw in the targeted API endpoint enables command injection. An attacker within local network access can...
CVE-2025-2726
This CVE affects H3C Magic NX15, NX30 Pro, NX400, R3010 and BE18000 (up to V100R014). The vulnerability resides in the HTTP POST Request Handler’s /api/esps endpoint, where exploitation leads to command injection. Access from the local network is required; the issue has been disclosed publicly. R...
CVE-2025-2725 H3C Magic BE18000 HTTP POST Request auth command injection
A vulnerability classified as critical was found in H3C Magic NX15, Magic NX30 Pro, Magic NX400, Magic R3010 and Magic BE18000 up to V100R014. Affected by this vulnerability is an unknown functionality of the file /api/login/auth of the component HTTP POST Request Handler. The manipulation leads ...
CVE-2025-2723
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: The code maintainer explains that "the call is invalid as the buffer pointed to by "data" must have...
CVE-2025-2722
Removed by vendor...
CVE-2025-2720
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: According to the code maintainer the call of the POC is invalid because the buffer pointed to by "data...
CVE-2025-2720
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: According to the code maintainer the call of the POC is invalid because the buffer pointed to by "data...