2156 matches found
CVE-2025-41069
The vulnerability is an Insecure Direct Object Reference (IDOR) in DeporSite of T-INNOVA. An attacker can manipulate requests via the idUsuario parameter in /ajax/TInnova_v2/Formulario_Consentimiento/llamadaAjax/obtenerDatosConsentimientos to access or modify resources they should not. Documented...
EUVD-2025-141903
Malicious code in goodafiun-t-gif npm...
EUVD-2025-140128
Malicious code in min-te-t npm...
Malicious code in min-te-t (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9260e86996f0555471b69a68be4b4d5d1308c823e7b73cdc9b6a174e6d201e2b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in guras-asia-t (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 87b1c8b4b6a595142fbaf255a932612159acf70fb1a9feaca12e2fa2f388180f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-147237
Malicious code in uaragifa-t-safar npm...
EUVD-2025-150157
Malicious code in t-naughty-nubliesp npm...
MAL-2025-166655 Malicious code in t-naughty-nubliesp (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e84e11e66fe284c711eb287567cf0d80a6b5ac9783fbec275c9c641319fe1c19 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
SQL Injection Vulnerability in Changjitong T+ of Changjitong Information Technology Co., Ltd (CNVD-C-2025-797319)
T+ is a dynamic, intelligent and fashionable Internet management software, mainly for small and medium-sized industrial, trade and commerce enterprises with integrated financial and business applications, incorporating elements of socialization, mobility, Internet of Things, e-commerce and Intern...
Linanto Control Web Panel (CWP) < 0.9.8.1205 Command Injection (CVE-2025-48703)
The version of Linanto Control Web Panel CWP, a web based control panel application, installed on the remote host is prior to 0.9.8.1205. It is, therefore, affected by a remote code execution via shell metacharacters in the ttotal parameter in a filemanager changePerm request. Note that Nessus ha...
SQL Injection Vulnerability in Changjitong T+ of Changjitong Information Technology Co. Ltd (CNVD-C-2025-778387)
T+ is a dynamic, intelligent and fashionable Internet management software, mainly for small and medium-sized industrial, trade and commerce enterprises with integrated financial and business applications, incorporating elements of socialization, mobility, Internet of Things, e-commerce and Intern...
SUSE CVE-2025-40044
In the Linux kernel, the following vulnerability has been resolved: fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set...
CVE-2025-40044 fs: udf: fix OOB read in lengthAllocDescs handling
In the Linux kernel, the following vulnerability has been resolved: fs: udf: fix OOB read in lengthAllocDescs handling When parsing Allocation Extent Descriptor, lengthAllocDescs comes from on-disk data and must be validated against the block size. Crafted or corrupted images may set...
Everest Ransomware Claims AT&T Careers Breach with 576K Records
Everest ransomware group claims a breach of AT&T Careers, alleging theft of 576,000 applicant and employee records locked behind a password-protected listing...
Researchers Warn RondoDox Botnet is Weaponizing Over 50 Flaws Across 30+ Vendors
Malware campaigns distributing the RondoDox botnet have expanded their targeting focus to exploit more than 50 vulnerabilities across over 30 vendors. The activity, described as akin to an "exploit shotgun" approach, has singled out a wide range of internet-exposed infrastructure, including...
CVE-2025-61863
An out-of-bounds read vulnerability exists in VS6ComFile!CSaveData::deletemem of V-SFT v6.2.7.0 and earlier. Opening specially crafted V-SFT files may lead to information disclosure, affected system's abnormal end ABEND, and arbitrary code execution...
Fuji Electric V-SFT 缓冲区错误漏洞
Fuji Electric V-SFT is a screen configuration software from Fuji Electric Japan. A buffer error vulnerability exists in Fuji Electric V-SFT v6.2.7.0 and earlier versions, which stems from an out-of-bounds write to VS6ComFile!CItemDraw::ismotiontween, which could lead to information disclosure,...
EUVD-2017-5627
Malware in sbrugna...