12952 matches found
GHSA-M5GV-VJ3F-6V2P Liferay Portal and DXP Instance Admin can execute code using Objects Actions and Validations
In Liferay Portal 7.4.3.27 through 7.4.3.42, and Liferay DXP 2024.Q1.1 through 2024.Q1.20, 2023.Q4.0 through 2023.Q4.10, 2023.Q3.1 through 2023.Q3.10, 7.4 update 27 through update 42 Liferay PaaS, and Liferay Self-Hosted, the Objects module does not restrict the use of Groovy scripts in Object...
Malicious Package
Overview browser-client-neptune is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
Malicious Package
Overview afruitmaliciousxmlparser is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this...
urllib3 allows an unbounded number of links in the decompression chain
...
XWiki Platform 安全漏洞
XWiki Platform is XWiki's open source suite of Wiki platforms for creating web collaboration applications. A security vulnerability exists in XWiki Platform that stems from vulnerability to reflective cross-site scripting attacks...
CVE-2025-42875
The SAP Internet Communication Framework does not conduct any authentication checks for features that need user identification allowing an attacker to reuse authorization tokens, violating secure authentication practices causing low impact on Confidentiality, Integrity and Availability of the...
Deepfakes, AI resumes, and the growing threat of fake applicants
Recruiters expect the odd exaggerated resume, but many companies, including us here at Malwarebytes, are now dealing with something far more serious: job applicants who aren't real people at all. From fabricated identities to AI-generated resumes and outsourced impostor interviews, hiring pipelin...
kernel: ice: ice_adapter: release xa entry on adapter allocation failure
A NULL pointer dereference exists in the Linux kernel such that ice: iceadapter fails to release a reserved XArray entry when iceadapternew fails. As a result, subsequent insertions at the same index may return -EBUSY, which can lead to damage to system availability, integrity, and confidentialit...
NVIDIA NVTabular 代码问题漏洞
NVIDIA NVTabular is a component of a deep learning recommender system framework from NVIDIA, USA. A deserialization vulnerability exists in NVIDIA NVTabular, which arises from unsafe deserialization of serialized data received from users by the Workflow component and can be exploited by an attack...
EUVD-2025-201794
The Litmus platform uses JWT for authentication and authorization, but the secret being used for signing the JWT is only 6 bytes long at its core, which makes it extremely easy to crack...
Adobe Experience Manager (AEM) CRX Namespace Editor Panel Detected
This plugin detects the presence of the Adobe Experience Manager AEM CRX Namespace Editor panel on a web application. The CRX Namespace Editor panel is part of the AEM's content repository management interface, allowing administrators to manage namespaces and node types within the repository...
Malicious code in elf-stats-magical-sleigh-777 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f73e5e3034697e77965b67b4588a8e173d9c37347df921cf4e0c4085a993249a The package elf-stats-magical-sleigh-777 was found to contain malicious code...
EUVD-2025-200282
Malicious code in wfui-dsm-react-ui npm...
Grav is vulnerable to Server-Side Template Injection (SSTI) via Forms
Summary Having a simple form on site can reveal the whole Grav configuration details including plugin configuration details by using the correct POST payload. Sensitive information may be contained in the configuration details. PoC Create a simple form with two fields, 'registration-number' and...
Grav vulnerable to Cross-Site Scripting (XSS) Stored endpoint `/admin/pages/[page]` parameter `data[header][template]` in Advanced Tab
Summary A Stored Cross-Site Scripting XSS vulnerability was identified in the /admin/pages/page endpoint of the Grav application. This vulnerability allows attackers to inject malicious scripts into the dataheadertemplate parameter. The script is saved within the page's frontmatter and executed...
EUVD-2025-200125
rtvm-interpreter lacks sufficient checks in public API...
Is Vibe Coding Safe? Benchmarking Vulnerability of Agent-Generated Code in Real-World Tasks
Vibe coding is a new programming paradigm in which human engineers instruct large language model LLM agents to complete complex coding tasks with little supervision. Although it is increasingly adopted, are vibe coding outputs really safe to deploy in production? To answer this question, we propo...
Security Bulletin: Astronomer with IBM is vulnerable to session security compromise due to the CIRCL package (CVE-2025-8556)
Summary CIRCL is used by Astronomer with IBM as part of crytographic processing functionality. Vulnerability Details CVEID:CVE-2025-8556 DESCRIPTION: A flaw was found in CIRCL's implementation of the FourQ elliptic curve. This vulnerability allows an attacker to compromise session security via...
GHSA-9G7V-8WXV-MWXP Duplicate Advisory: Keras keras.utils.get_file API is vulnerable to a path traversal attack
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-hjqc-jx6g-rwp9. This link is maintained to preserve external references. Original Description Keras version 3.11.3 is affected by a path traversal vulnerability in the keras.utils.getfile function when extractin...