EUVD-2006-3228

Malware in sbrugna...

EUVD-2006-6620

Malware in sbrugna...

EUVD-2016-2332

Malware in sbrugna...

EUVD-2023-3019

Malicious code in bioql PyPI...

EUVD-2023-2954

Malicious code in bioql PyPI...

EUVD-2024-1511

Malicious code in bioql PyPI...

EUVD-2022-34666

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: bom, grafana-alloy, kapp, zot, plugin-barman-cloud, neuvector-sigstore-interface, aws-application-networking-k8s, harbor-registry, hubble, eck-operator, chartmuseum, rabbitmq-messaging-topology-operator, wait-for-port, linkerd2-cni-plugin, docker-cli-buildx,...

CVE-2025-59049

Mockoon before 9.2.0 is affected by a Path Traversal and Local File Inclusion (LFI) in the static file serving endpoint. The issue stems from unsafe templating of the server filename using user input, enabling an attacker to read arbitrary files from the mock server filesystem. A fix is available...

CVE-2025-59049 Mockoon has a Path Traversal and LFI in the static file serving endpoint

Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal...

CVE-2025-59049 Mockoon has a Path Traversal and LFI in the static file serving endpoint

Mockoon provides way to design and run mock APIs. Prior to version 9.2.0, a mock API configuration for static file serving follows the same approach presented in the documentation page, where the server filename is generated via templating features from user input is vulnerable to Path Traversal...

GHSA-G4JQ-H2W9-997C Vite middleware may serve files starting with the same name with the public directory

Summary Files starting with the same name with the public directory were served bypassing the server.fs settings. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - uses the public...

Linux Distros Unpatched Vulnerability : CVE-2025-0649

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect JSON input stringification in Google's Tensorflow serving versions up to 2.18.0 allows for potentially unbounded recursion leading to server crash...

Linux Distros Unpatched Vulnerability : CVE-2023-5548

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Stronger revision number limitations were required on file serving endpoints to improve cache poisoning protection. CVE-2023-5548 Note that Nessus relies on the...

linux-smart-enumeration

First, a couple of useful oneliners ; console wget "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -O lse.sh;chmod 700 lse.sh console curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo lse.sh;chmod 700...

CVE-2025-3264

A Regular Expression Denial of Service ReDoS vulnerability was discovered in the Hugging Face Transformers library, specifically in the getimports function within dynamicmoduleutils.py. This vulnerability affects versions 4.49.0 and is fixed in version 4.51.0. The issue arises from a regular...

TencentOS Server 4: rubygem-rack (TSSA-2025:0364)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2025:0364 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the report serving functionality. An attacker capable of changing report content can bypass the Content-Security-Policy introduced in Jenkins 1.641 and 1.625.3. Workaround Affected users are advised to...

PT-2025-24276 · Jenkins · Jenkins Gatling Plugin

Name of the Vulnerable Software and Affected Versions: Jenkins Gatling Plugin version 136.vb 9009b 3d33a e Description: The issue allows users who can change report content to exploit a cross-site scripting XSS vulnerability due to the manner in which Gatling reports are served, bypassing the...

CVE-2024-36427

The file-serving function in TARGIT Decision Suite before 24.06.19002 TARGIT Decision Suite 2024 – June allows authenticated attackers to read or write to server files via a crafted file request. This can allow code execution via a .xview file...