12890 matches found
Vault Terraform Provider Applied Incorrect Defaults for LDAP Auth Method
Summary Vault’s Terraform Provider incorrectly set the default denynullbind parameter for the LDAP auth method to false by default, potentially resulting in an insecure configuration. If the underlying LDAP server allowed anonymous or unauthenticated binds, this could result in authentication...
EUVD-2025-198361
IBM Concert 1.0.0 through 2.0.0 could disclose sensitive server information from HTTP response headers that could aid in further attacks against the system...
The vulnerability of the WebGPU API interface in Mozilla Firefox and the Thunderbird email client allows attackers to bypass the sandbox protection mechanisms and compromise the confidentiality, integrity, and accessibility of protected information.
The vulnerability of the WebGPU API interface in Mozilla Firefox and the Thunderbird email client is related to incorrect handling of exceptional states. Exploiting this vulnerability can allow an attacker to bypass the sandboxing mechanisms and compromise the confidentiality, integrity, and...
PT-2025-47240
Observable Timing Discrepancy CWE-208 in HBUS devices may allow an attacker with physical access to the device to extract device-specific keys, potentially compromising further site security. This issue affects Command Centre Server: 9.30 prior to vCR9.30.251028a distributed in 9.30.2881 MR3, 9.2...
Siemens SCALANCE and RUGGEDCOM Devices Improper Input Validation (CVE-2024-42105)
nilfs2: use-after-free. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-ot for more information. %NASLMINLEVEL 80900 C Tenable, Inc. include'compat.inc'; if description scriptid504674; scriptversion"1.3";...
CVE-2025-36299
IBM Planning Analytics Local 2.1.0 through 2.1.14 stores sensitive information in source code could be used in further attacks against the system...
EUVD-2025-197815
QaTraq 6.9.2 ships with administrative account credentials which are enabled in default installations and permit immediate login via the web application login page. Because the account provides administrative privileges in the default configuration, an attacker who can reach the login page can ga...
CVE-2024-21635
Memos is a privacy-first, lightweight note-taking service that uses Access Tokens to authenticate application access. When a user changes their password, the existing list of Access Tokens stay valid instead of expiring. If a user finds that their account has been compromised, they can update the...
EUVD-2025-178622
Malicious code in hadron-postgres-phylogenetics-loop npm...
EUVD-2025-177620
Malicious code in nextjs-event-chromedriver-pm2 npm...
EUVD-2025-176116
Malicious code in supernova-apex-brane-callback npm...
EUVD-2025-180164
Malicious code in babel-baryon-magellan-prettier-plugin-markdown npm...
EUVD-2025-178428
Malicious code in index-short-java-phi-virtualize npm...
Malicious code in radiant-event-bootstrap-geodynamo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d884f8f8fe69d800ff13733a4da5865fd63f1846cee21ddf7997124ae41773ef This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-178997
Malicious code in exec-antimatter-jovian-postgres npm...
EUVD-2025-175401
Malicious code in zero-finally-new-easy-phi npm...
EUVD-2025-176166
Malicious code in subduction-exec-redis-gatsby npm...
EUVD-2025-179142
Malicious code in encode-rain-refactor-execute-pi npm...
MAL-2025-185668 Malicious code in auth0-stratigraphy-ursa-cordelia (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 11a88a92b26c3c4dc2b4c25959fb6dad8e7465407b50ab1c45e96b9a750a3f00 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...