815 matches found
Malicious code in muddy-salmon-cuckoo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de26ff577cf8f93895f8b3017e31b06399d6a83a642f16dd9420952661bb8f6b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in citra-takokak21-sluey (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1362e2712cc20665c5aa21c830173a839e5907feac543971c49221f91e59e812 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
CVE-2025-63296
KERUI K259 5MP Wi-Fi / Tuya Smart Security Camera firmware v33.53.87 contains a code execution vulnerability in its boot/update logic: during startup /usr/sbin/anykaservice.sh scans mounted TF/SD cards and, if /mnt/update.nor.sh is present, copies it to /tmp/net.sh and executes it as root...
WordPress SH Contextual Help plugin <= 3.2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability
Cross-Site Request Forgery to Stored Cross-Site Scripting vulnerability discovered by johska in WordPress Plugin SH Contextual Help versions = 3.2.1...
PT-2025-44956
The SH Contextual Help plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation in the sh contextual help dashboard widget function. This makes it possible for unauthenticated attackers to...
Path Traversal
esm.sh is vulnerable to Path Traversal. The vulnerability is due to improper validation of the X-Zone-Id HTTP header when constructing filesystem paths, which allows an attacker to use ../ sequences to write files outside the intended storage directory and access arbitrary locations on the system...
CVE-2025-34515 Ilevia EVE X1 Server 4.7.18.0.eden Root Privilege Escalation
Ilevia EVE X1 Server firmware versions ≤ 4.7.18.0.eden contain an execution with unnecessary privileges vulnerability in syncproject.sh that allows an attacker to escalate privileges to root. Ilevia has declined to service this vulnerability, and recommends that customers not expose port 8080 to...
EUVD-2000-1119
Malware in sbrugna...
EUVD-2006-1780
Malware in sbrugna...
EUVD-2007-3519
Malware in sbrugna...
EUVD-2006-6784
Malware in sbrugna...
EUVD-2008-6626
Malware in sbrugna...
EUVD-2007-6357
Malware in sbrugna...
EUVD-2006-3243
Malware in sbrugna...
EUVD-2006-3244
Malware in sbrugna...
EUVD-2024-45570
Malicious code in bioql PyPI...
Advisory ROSA-SA-2025-3014
software: cert-sh-functions 1.0.6 WASP: ROSA-CHROME unaffected versions = cert-sh-functions-1.0.6-5 affected versions cert-sh-functions-1.0.6-5 CVE-ID: CVE-2022-30550 BDU-ID: 2022-04273 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the passdb account database of the Dovecot mail server is relate...
CVE-2025-57431
The Sound4 PULSE-ECO AES67 1.22 web-based management interface is vulnerable to Remote Code Execution RCE via a malicious firmware update package. The update mechanism fails to validate the integrity of manual.sh, allowing an attacker to inject arbitrary commands by modifying this script and...
CVE-2025-59341
esm.sh is a nobuild content delivery networkCDN for modern web development. In 136 and earlier, a Local File Inclusion LFI issue was identified in the esm.sh service URL handling. An attacker could craft a request that causes the server to read and return files from the host filesystem or other...
