Siemens多款产品 信任管理问题漏洞

Siemens NX and others are products of Siemens, a German company.Siemens NX is Siemens COMOS is a process industry operations management software.Siemens JT Bi-Directional Translator for STEP is a data conversion tool. A trust management issue vulnerability exists in various Siemens products that...

CVE-2025-14204 TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command injection

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

PT-2025-49418

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

CVE-2025-14204: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

Security Bulletin: Multiple Vulnerabilities affect IBM Watson Studio in Cloud Pak for Data.

Summary Multiple vulnerabilities have been addressed in IBM Watson Studio in Cloud Pak for Data version 5.2.2 Vulnerability Details CVEID:CVE-2024-3568 DESCRIPTION: The huggingface/transformers library is vulnerable to arbitrary code execution through deserialization of untrusted data within the...

📄 Visual Studio 1.39.0 Remote Debugger

Visual Studio versions 1.30.0 through 1.39.0 had a remote debugger enabled by default that could cause multiple security issues. Code included to scan for any listeners...

GlassWorm Returns with 24 Malicious Extensions Impersonating Popular Developer Tools

The supply chain campaign known as GlassWorm has once again reared its head, infiltrating both Microsoft Visual Studio Marketplace and Open VSX with 24 extensions impersonating popular developer tools and frameworks like Flutter, React, Tailwind, Vim, and Vue. GlassWorm was first documented in...

Advisory ROSA-SA-2025-3087

Software: git 1.8.3.1 OS: rosa-server79 unaffected versions = git-1.8.3.1-25.0.1.res7 affected versions git-1.8.3.1-25.0.1.1.res7 CVE-ID: CVE-2025-48384 BDU-ID: 2025-08691 CVE-Crit: HIGH CVE-DESC.: A vulnerability in the Git distributed version control system of the Microsoft Visual Studio softwa...

Missing Authorization

Overview label-studio-sso is a Native JWT authentication for Label Studio OSS - simple and secure SSO integration Affected versions of this package are vulnerable to Missing Authorization due to missing validation in the SSO token API. The API does not restrict account creation to pre-registered...

Cross-site Request Forgery (CSRF)

Overview label-studio-sso is a Native JWT authentication for Label Studio OSS - simple and secure SSO integration Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF due to an improper exemption in the JWTSSOSessionAuthentication mechanism that disables CSRF token...

kyoukai (>=2.2.0, <=2.2.1), mezmorize (>=0.18.1, <=0.25.0) +2 more potentially affected by CVE-2025-66221 via werkzeug (0.13.0)

werkzeug PYPI version 0.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on werkzeug and may be impacted: - kyoukai =2.2.0, =0.18.1, =0.49.2, =0.0.0.1, =0.0.3 Source cves: CVE-2025-66221 Source advisory: OSV:GHSA-HGF8-39GV-G3F2...

Microsoft Visual Studio Code Editor Access Control RCE

The vulnerability of Microsoft Visual Studio Code’s editor is related to access control errors. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Security Update for Microsoft Visual Studio Code CoPilot Chat Extension (November 2025)

The Microsoft Visual Studio Code CoPilot Chat Extension prior to version 0.32.5. It is, therefore, affected by multiple vulnerabilities. - This vulnerability is a command injection flaw in the Visual Studio Code Copilot Chat Extension, where improper handling of special characters in...

Visual Studio Tools for Applications Elevation of Privilege (CVE-2025-29803)

In VSTA 2019 prior 16.0.35907.0 and VSTA 2022 prior to 17.0.35906.0, the software contains a vulnerability CVE-2025-29803 that could allow remote or local attackers to execute arbitrary code or escalate privileges within the host application, potentially compromising systems that rely on VSTA for...

EUVD-2025-198898

Malicious code in @asyncapi/studio npm...

@asyncapi/cli (>=1.4.0, <=2.16.7) potentially affected by unknown CVE via @asyncapi/studio (0.20.2)

@asyncapi/studio NPM version 0.20.2 is affected by a known vulnerability. The following packages have a transitive dependency on @asyncapi/studio and may be impacted: - @asyncapi/cli =1.4.0, =2.16.7 Source cves: unknown CVE Source advisory: OSV:MAL-2025-190863...

Malicious code in @asyncapi/studio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eabd7c33d6759f64f573e5cc75565c4669ed790fe45d77d2756d1380b79063f The package @asyncapi/studio was found to contain malicious code. Source: ghsa-malware be3f6f1fe39d5dd5c1ee3ab702e2bee67bc36c54ded865ad25eb2504919b58...

MAL-2025-190863 Malicious code in @asyncapi/studio (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3eabd7c33d6759f64f573e5cc75565c4669ed790fe45d77d2756d1380b79063f The package @asyncapi/studio was found to contain malicious code. Source: ghsa-malware be3f6f1fe39d5dd5c1ee3ab702e2bee67bc36c54ded865ad25eb2504919b58...

Fake Prettier Extension on VSCode Marketplace Dropped Anivia Stealer

Cybersecurity firm Checkmarx Zero, in collaboration with Microsoft, removed a malicious 'prettier-vscode-plus' extension from the VSCode Marketplace. The fake coding tool was a Brandjacking attempt designed to deploy Anivia Stealer malware and steal Windows user credentials and data...

ROS-20251124-01

A vulnerability in the ASP.NET Core software platform and Microsoft's software development tool, Visual Studio, is related to authentication bypass. Visual Studio is related to authentication bypass. Exploitation of the vulnerability could allow an attacker, acting remotely to escalate their...