Hcl Inotes 安全漏洞

HCL Hcl Inotes is a software from HCL India that allows management of IBMDomino emails, scheduling of errands and other office activity management. A security vulnerability exists in Hcl Inotes that stems from improper validation of user input and could lead to a reflective cross-site scripting...

PT-2025-48031

Name of the Vulnerable Software and Affected Versions mJobtime version 15.7.2 Description The software handles authorization on the client side, allowing an attacker to modify the client-side code and gain access to administrative features. Attackers can craft requests based on the modified...

Photon OS 4.0: Linux PHSA-2025-4.0-0913

An update of the linux package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-4.0-0913. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

A Reality Check on SBOM-Based Vulnerability Management: An Empirical Study and a Path Forward

The Software Bill of Materials SBOM is a critical tool for securing the software supply chain SSC, but its practical utility is undermined by inaccuracies in both its generation and its application in vulnerability scanning. This paper presents a large-scale empirical study on 2,414 open-source...

PT-2025-48084

An issue was discovered in jishenghua JSH ERP 2.3.1. The /role/addcan endpoint is vulnerable to fastjson deserialization attacks...

EUVD-2025-199272

Malicious code in quickswap-sdk npm...

MAL-2025-191426 Malicious code in simplejsonform (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d512e223b9a2375fd46539f1b0434e092f755c299f20b1d054c538228d266436 The package simplejsonform was found to contain malicious code. Source: ghsa-malware fd81fbb7b9cb8cfc5e4444da9cd2d18ed54ec4b7bb741f0ad95a56ce29a5edd0...

EUVD-2025-199323

Malicious code in @everreal/react-charts npm...

EUVD-2025-199109

Malicious code in @oku-ui/slot npm...

Malicious code in ids-enterprise-typings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d2289786c3e4396ada63a5a2651f54fc6a55d011e2b5f8acccb8aa21b11cab The package ids-enterprise-typings was found to contain malicious code. Source: ghsa-malware...

Malicious code in @relyt/claude-context-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c316b01a92bfd324ed27916a84ad109a9a198650509ea633aaa7ab97e5afcf9 The package @relyt/claude-context-core was found to contain malicious code. Source: ghsa-malware...

EUVD-2025-199022

Malicious code in template-lib npm...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code associated with the Sha1-hulud supply chain attack, and its content was removed from the official package manager. The malware functions as a self-replicating worm capable of...

Is Your Android TV Streaming Box Part of a Botnet?

On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix , ESPN and Hulu , all for a one-time fee of around $400. But security experts...

CVE-2025-63958

MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint /MILLENSYS/settings that is accessible without authentication. This page leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters. An...

CVE-2025-63958

MILLENSYS Vision Tools Workspace 6.5.0.2585 exposes a sensitive configuration endpoint /MILLENSYS/settings that is accessible without authentication. This page leaks plaintext database credentials, file share paths, internal license server configuration, and software update parameters. An...

K000157948: BIND vulnerability CVE-2025-40780

Security Advisory Description In specific circumstances, due to a weakness in the Pseudo Random Number Generator PRNG that is used, it is possible for an attacker to predict the source port and query ID that BIND will use. This issue affects BIND 9 versions 9.16.0 through 9.16.50, 9.18.0 through...

Server-Side Request Forgery (SSRF)

vllm is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient restrictions on user-supplied URLs in the MediaConnector class’s loadfromurl and loadfromurlasync methods, which allows an attacker to coerce the server into making arbitrary internal network requests...

CVE-2025-13545

A security vulnerability has been detected in ashraf-kabir travel-agency up to 1f25aa03544bc5fb7a9e846f8a7879cecdb0cad3. Affected by this vulnerability is an unknown functionality of the file /adminarea/index.php. The manipulation of the argument editpack leads to sql injection. The attack can be...

CVE-2025-56400

Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...