sonic-server 安全漏洞

Sonic-server is a mobile device remote debugging and automated testing platform open source by Sonic Cloud Org. Versions of sonic-server 2.0.0 and earlier contain security vulnerabilities. These vulnerabilities stem from improper handling of parameter types in the Upload function of the File Uplo...

MAL-2026-2180 Malicious code in sonic-config-engine (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 2385b46fee4fb7241c2f3f692934017f39660c9694b98b92cbe3dae6555e5b05 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Sonic-go-brrr-CTF-exploit-Code

This Code customized for Solve Cyber Talent CTF Sonic go...

CVE-2019-12968

A vulnerability was found in the Sonic Robo Blast 2 SRB2 plugin EPVersions 9 to 11 inclusive distributed with Doomseeker 1.1 and 1.2. Affected plugin versions did not discard IP packets with an unnaturally long response length from a Sonic Robo Blast 2 master server, allowing a remote attacker to...

CVE-2025-15414

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

EUVD-2025-206134

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing manipulation of the argument uri can lead to server-side request forgery. The attack may be launched remotely...

CVE-2025-15414

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

CVE-2025-15414 go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

CVE-2025-15414 go-sonic Theme Fetching API git_fetcher.go FetchTheme server-side request forgery

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

CVE-2025-15414

A flaw has been found in go-sonic sonic up to 1.1.4. The affected element is the function FetchTheme of the file service/theme/gitfetcher.go of the component Theme Fetching API. Executing a manipulation of the argument uri can lead to server-side request forgery. The attack may be launched...

CVE-2025-15414

The CVE-2025-15414 issue affects go-sonic up to version 1.1.4, specifically the FetchTheme function in service/theme/git_fetcher.go of the Theme Fetching API. The root cause is manipulation of the uri argument that enables server-side request forgery (SSRF), with the attack potentially executable...

PT-2026-1030

Name of the Vulnerable Software and Affected Versions go-sonic versions up to 1.1.4 Description A server-side request forgery issue exists in the Theme Fetching API of go-sonic. The flaw is located in the FetchTheme function within the service/theme/git fetcher.go file. Manipulation of the uri...

Sonic 代码问题漏洞

Sonic is a go-sonic open source high performance blogging system developed using golang. A code issue vulnerability exists in Sonic 1.1.4 and earlier versions, which stems from the incorrect operation of the parameter uri in the FetchTheme function in the Theme Fetching API component file...

Microsoft Azure 安全漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft Corporation USA. A security vulnerability exists in Microsoft Azure that stems from a stack-based buffer overflow in the Software for Open Networking in the Cloud SONiC allowing an unauthorized attacker ...

Malicious code in sonic-kg-tifffacfav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fe0caf3184bb437b8a797b85f0fa626b76271b47cb60b138f087dd24fa586192 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kat-ihu (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 401662b1dcf1ce86735ff7b77e3283e697224dfa160dc13d35fa76af925b1399 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-ijos-afafioah (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5fad0db5d320e176329cd15727176e57938087a605365c21efaca1fb49485c89 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kg-tiav (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3d8765cb416d290f51e091b7f41eed70c0d2949e48b83cdc84ddde54afe7c17b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kuloig-tgvi (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector af44fb55835cb07e0e5094e85d79087ba5baf4266bf6453d544cf8faf1af3e93 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in sonic-kaos-fagfa (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 37d96e7e46cf201f2af3ad308147dcc651e487f073b98e130848317e0732d395 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...