3945 matches found
EUVD-2025-26294
Malicious code in bioql PyPI...
EUVD-2022-1622
Malicious code in bioql PyPI...
EUVD-2025-18996
Malicious code in bioql PyPI...
EUVD-2025-19736
Malicious code in bioql PyPI...
EUVD-2024-54595
Malicious code in bioql PyPI...
CVE-2025-55971
TCL 65C655 Smart TV, running firmware version V8-R75PT01-LF1V269.001116 Android TV, Kernel 5.4.242+, is vulnerable to a blind, unauthenticated Server-Side Request Forgery SSRF vulnerability via the UPnP MediaRenderer service AVTransport:1. The device accepts unauthenticated SetAVTransportURI SOAP...
TCL 65C655 Smart TV 安全漏洞
TCL 65C655 Smart TV is a Smart TV from TCL Corporation of China. A security vulnerability exists in the TCL 65C655 Smart TV, which stems from the UPnP control endpoint being susceptible to a malformed or oversized SOAP request attack, which could result in a denial of service...
CVE-2025-1862
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By...
CVE-2025-1862 Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By...
CVE-2025-1862 Authenticated Arbitrary File Upload in Multiple WSO2 Products via BPEL Uploader SOAP Service Leading to Remote Code Execution
An arbitrary file upload vulnerability exists in multiple WSO2 products due to improper validation of user-supplied filenames in the BPEL uploader SOAP service endpoint. A malicious actor with administrative privileges can upload arbitrary files to a user-controlled location on the server. By...
CVE-2025-10779
A vulnerability was found in D-Link DCS-935L up to 1.13.01. The impacted element is the function sub402280 of the file /HNAP1/. The manipulation of the argument HNAPAUTH/SOAPAction results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and...
CVE-2025-10779
A vulnerability was found in D-Link DCS-935L up to 1.13.01. The impacted element is the function sub402280 of the file /HNAP1/. The manipulation of the argument HNAPAUTH/SOAPAction results in stack-based buffer overflow. The attack may be launched remotely. The exploit has been made public and...
D-Link DCS-935L 安全漏洞
The D-Link DCS-935L is a router from China's AUO D-Link. A buffer overflow vulnerability exists in D-Link DCS-935L version 1.13.01 and earlier, which originates from the parameter HNAPAUTH/SOAPAction in file /HNAP1/ that fails to correctly validate the length and size of the input data, and can b...
CVE-2025-10689 D-Link DIR-645 soap.cgi soapcgi_main command injection
A vulnerability was identified in D-Link DIR-645 105B01. This issue affects the function soapcgimain of the file /soap.cgi. Such manipulation of the argument service leads to command injection. The attack can be launched remotely. The exploit is publicly available and might be used. This...
CVE-2025-54391
A vulnerability in the EnableTwoFactorAuthRequest SOAP endpoint of Zimbra Collaboration ZCS allows an attacker with valid user credentials to bypass Two-Factor Authentication 2FA protection. The attacker can configure an additional 2FA method either a third-party authenticator app or email-based...
CVE-2025-54390
Zimbra Collaboration (ZCS) CVE-2025-54390 is a CSRF in ResetPasswordRequest when zimbraFeatureResetPasswordStatus is enabled. An attacker can trick an authenticated user into visiting a malicious page that silently sends a crafted SOAP request to reset the user’s password due to missing CSRF toke...
CVE-2025-54390
A Cross-Site Request Forgery CSRF vulnerability exists in the ResetPasswordRequest operation of Zimbra Collaboration ZCS when the zimbraFeatureResetPasswordStatus attribute is enabled. An attacker can exploit this by tricking an authenticated user into visiting a malicious webpage that silently...
PT-2025-38678
Name of the Vulnerable Software and Affected Versions D-Link DCS-935L versions prior to 1.13.01 Description A stack-based buffer overflow issue exists in the sub 402280 function of the /HNAP1/ file. The issue is due to the manipulation of the HNAP AUTH/SOAPAction argument, which can allow a remot...
