13120 matches found
BELL-CVE-2025-27832
Bulletin has no description...
BELL-CVE-2025-27831
Bulletin has no description...
H2O Vulnerable to Arbitrary File Overwrite via File Export
In h2oai/h2o-3 version 3.46.0, the endpoint for exporting models does not restrict the export location, allowing an attacker to export a model to any file in the server's file structure, thereby overwriting it. This vulnerability can be exploited to overwrite any file on the target server with a...
DLA-4088-1 php7.4 - security update
Bulletin has no description...
GHSA-QMG3-HPQR-GQVC Multiple Reviewdog actions were compromised during a specific time period
Summary reviewdog/action-setup@v1 was compromised March 11, 2025, between 18:42 and 20:31 UTC, with malicious code added that dumps exposed secrets to Github Actions Workflow Logs. Other reviewdog actions that use reviewdog/action-setup@v1 would also be compromised, regardless of version or pinni...
RHSA-2025:3025 Red Hat Security Advisory: kernel security update
Bulletin has no description...
MAL-2025-3450 Malicious code in logax (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 e129e6d6d38e21a039bd2190e3138f1381ad386e45a49521621a8b8ad61f7678 The package is capable of installing malware from a hardcoded URL. The malware is well-recognized and acts as infostealer. Interestingly, it uses Steam profile...
MAL-2025-2508 Malicious code in gatsby-starter-hello-world (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6c7747634dd4e3ce4eb97de472957ba6fd913f4eff5887068d5d266c4957908 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2518 Malicious code in near-lake-raw-printer (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e593a192910f4a7cb2542c2fb2974be98c92be795c5ab639f2d5b31f6e88e0fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2025-26886
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in PublishPress PublishPress Authors publishpress-authors allows SQL Injection.This issue affects PublishPress Authors: from n/a through = 4.7.3...
CVE-2025-26555
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Thorsten Ott Debug-Bar-Extender debug-bar-extender allows Reflected XSS.This issue affects Debug-Bar-Extender: from n/a through = 0.5...
MAL-2025-3429 Malicious code in asynchttpx (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 5b8f233eae76de4578a7b30c6564338d644a7dfa1f59682337792de5ad13668f Importing the module starts downloading and executing first a script, and then a widely identified malware Packages are used as dependencies in a GitHub projec...
RLSA-2024:11111 Moderate: python3.11 security update
Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic data types and dynamic typing. Python supports interfaces to many system calls and libraries, as well as to various windowing systems. Security Fixes:...
RLSA-2024:10858 Important: ruby security update
Ruby is an extensible, interpreted, object-oriented, scripting language. It has features to process text files and to perform system management tasks. Security Fixes: rexml: REXML ReDoS vulnerability CVE-2024-49761 For more details about the security issues, including the impact, a CVSS score,...
RLSA-2024:11237 Moderate: libsndfile:1.0.31 security update
libsndfile is a C library for reading and writing files containing sampled sound, such as AIFF, AU, or WAV. Security Fixes: libsndfile: Segmentation fault error in oggvorbis.c:417 vorbisanalysiswrote CVE-2024-50612 For more details about the security issues, including the impact, a CVSS score,...
MAL-2025-2450 Malicious code in com.unity.testtools.codecoverage (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5ed939e317fc9dd609fd574e15a987ca53e56d84311ad769e3cd7ef39b3c76d1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
RHSA-2025:2867 Red Hat Security Advisory: grub2 security update
Bulletin has no description...
GHSA-89XP-C3MQ-QJ84 gurk (aka gurk-rs) mishandles ANSI escape sequences
gurk aka gurk-rs through 0.6.3 mishandles ANSI escape sequences...
CVE-2024-40590
An improper certificate validation vulnerability CWE-295 in FortiPortal version 7.4.0, version 7.2.4 and below, version 7.0.8 and below, version 6.0.15 and below when connecting to a FortiManager device, a FortiAnalyzer device, or an SMTP server may allow an unauthenticated attacker in a...
