Malvertising campaign leads to info stealers hosted on GitHub

In early December 2024, Microsoft Threat Intelligence detected a large-scale malvertising campaign that impacted nearly one million devices globally in an opportunistic attack to steal information. The attack originated from illegal streaming websites embedded with malvertising redirectors, leadi...

CVE-2025-26758

Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in RebelCode Spotlight Social Media Feeds spotlight-social-photo-feeds allows Retrieve Embedded Sensitive Data.This issue affects Spotlight Social Media Feeds: from n/a through = 1.7.1...

GHSA-GVVW-RR8M-FJ76 uniapi version 1.0.7 contained an information harvesting script.

uniapi version 1.0.7 introduces code that would execute on import of the module and download a script from a remote URL, and would then execute the downloaded script in a thread. The downloaded script would harvest system information and POST the information to another remote URL. This code was...

uniapi version 1.0.7 contained an information harvesting script.

uniapi version 1.0.7 introduces code that would execute on import of the module and download a script from a remote URL, and would then execute the downloaded script in a thread. The downloaded script would harvest system information and POST the information to another remote URL. This code was...

CVE-2023-38714

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system...

CVE-2023-38713 IBM Cloud Pak System information disclosure

IBM Cloud Pak System 2.3.3.0, 2.3.3.3, 2.3.3.3 iFix1, 2.3.3.4, 2.3.3.5, 2.3.3.6, 2.3.3.6 iFix1, 2.3.3.6 iFix2, 2.3.3.7, and 2.3.3.7 iFix1 could disclose sensitive information about the system that could aid in further attacks against the system...

PYSEC-2025-2 uniapi version 1.0.7 contained an information harvesting script.

uniapi version 1.0.7 introduces code that would execute on import of the module and download a script from a remote URL, and would then execute the downloaded script in a thread. The downloaded script would harvest system information and POST the information to another remote URL. This code was...

CVE-2025-0053

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an attacker to gain unauthorized access to system information. By using a specific URL parameter, an unauthenticated attacker could retrieve details such as system configuration. This has a limited impact on the confidentiality of...

SAP NetWeaver Application Server 安全漏洞

SAP NetWeaver Application Server is an application server from SAP, Germany. A security vulnerability exists in SAP NetWeaver Application Server ABAP that originates from allowing an attacker to gain unauthorized access to system information, and an unauthenticated attacker can retrieve detailed...

ABB Cylon Aspect 3.08.03 (CookieDB) SQL Injection

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an SQL injection through the...

ABB Cylon Aspect 3.08.02 (CookieDB) SQL Injection

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB BMS/BAS controller suffers from an SQL injection through the...

CVE-2025-0227

CVE-2025-0227 affects Tsinghua Unigroup Electronic Archives System 3.2.210802(62532). A vulnerability in the file /Logs/Annals/downLoad.html stems from manipulation of the path argument, resulting in information disclosure. The issue can be triggered remotely, and public exploit information exist...

Honor MagicOS 安全漏洞

Honor MagicOS is a mobile device operating system from Chinese company Honor Honor. A security vulnerability exists in Honor MagicOS, which stems from an information leakage vulnerability in some of Honor's products, the successful exploitation of which may result in the disclosure of some system...

Honor MagicOS 安全漏洞

Honor MagicOS is a mobile device operating system from Chinese company Honor Honor. A security vulnerability exists in Honor MagicOS, which stems from an information leakage vulnerability in some of Honor's products, the successful exploitation of which may result in the disclosure of some system...

Honor MagicOS 安全漏洞

Honor MagicOS is a mobile device operating system from Chinese company Honor Honor. A security vulnerability exists in Honor MagicOS, which stems from an information leakage vulnerability in some of Honor's products, the successful exploitation of which may result in the disclosure of some system...

CVE-2024-56334

systeminformation is a System and OS information library for node.js. In affected versions SSIDs are not sanitized when before they are passed as a parameter to cmd.exe in the getWindowsIEEE8021x function. This means that malicious content in the SSID can be executed as OS commands. This...

ABB Cylon Aspect 3.08.01 (portQueueAjax.php) Information Disclosure

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The portQueueAjax.php endpoint on ABB Cylon Aspect BMS/BAS controller...

ABB Cylon Aspect 3.08.02 Unauthenticated Configuration Disclosure

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB Cylon Aspect BMS/BAS system suffers from an unauthenticated...

ABB Cylon Aspect 3.08.02 (API/Servlets) Server-Side Request Forgery (SSRF)

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description ABB Cylon Aspect is affected by multiple Server-Side Request Forgery...

CVE-2024-53814

CVE-2024-53814 affects WordPress Analytify plugin (versions up to 5.4.3). The vulnerability is described as Exposure of Sensitive System Information to an Unauthorized Control Sphere (Broken Access Control), allowing unauthorized access to sensitive data. Public sources (Patchstack/Red Hat notes)...