The vulnerability of the Fortinet FortiManager software, which is used for centralized device management, as well as the FortiAnalyzer security event monitoring and analysis tools, stems from insecure privilege management. This allows attackers to escalate their privileges.

The vulnerability of the Fortinet FortiManager software, which is used for centralized device management, as well as the FortiAnalyzer security monitoring and analysis tools, is related to insecure privilege management. Exploiting this vulnerability can allow attackers to enhance their privileges...

CVE-2025-22870 vulnerabilities

Vulnerabilities for packages: kubernetes-csi-external-resizer-fips, crossplane-provider-sql-fips, kiali, crossplane, jitsucom-bulker, task, cert-manager-fips, docker-cli-buildx, prometheus-elasticsearch-exporter, envoy-gateway-fips, boring-registry, kargo, volume-modifier-for-k8s,...

Improper Verification Of Cryptographic Signature

dotnet-debugger-extensions, dotnet-dump and dotnet-sos are vulnerable to Improper Verification of Cryptographic Signature. The vulnerability is due to insufficient validation mechanisms, allowing an authorized attacker to execute code over a network...

MAL-2025-2276 Malicious code in relay-prototyping-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4755f649ce600841398c2b1dc4307b25489b71cb35ff35c8cd5be5dcac90bae8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in relay-prototyping-tools (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4755f649ce600841398c2b1dc4307b25489b71cb35ff35c8cd5be5dcac90bae8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Improper Isolation or Compartmentalization

Overview promptflow-tools is a Prompt flow built-in tools Affected versions of this package are vulnerable to Improper Isolation or Compartmentalization due to improper isolation or compartmentalization in the handling of Jinja templates. Remediation Upgrade promptflow-tools to version 1.6.0 or...

Steganography Explained: How XWorm Hides Inside Images

Inside the most innocent-looking image, a breathtaking landscape, or a funny meme, something dangerous could be hiding, waiting for its moment to strike. No strange file names. No antivirus warnings. Just a harmless picture, secretly concealing a payload that can steal data, execute malware, and...

CVE-2024-13853

The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13853

The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13853 SEO Tools <= 4.0.7 - Reflected XSS

The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2024-13853

The CVE-2024-13853 entry concerns the WordPress SEO Tools plugin (version up to 4.0.7). Affected component: rssread.php parameter handling of the 'src' parameter, where improper sanitisation/escaping allows reflected cross-site scripting. This could let an attacker execute arbitrary JavaScript in...

CVE-2024-13853 SEO Tools <= 4.0.7 - Reflected XSS

The SEO Tools WordPress plugin through 4.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Microsoft Azure 安全漏洞

Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from Microsoft USA. A security vulnerability exists in Microsoft Azure. An attacker exploiting this vulnerability could remotely execute code. The following products and versions are affected: Azure promptflow-core,Azu...

KLA81542 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. Type confusion vulnerability in .N...

WordPress plugin SEO Tools 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

SUSE SLES15 / openSUSE 15 : Recommended update 4.3.15 for Multi-Linux Manager Client Tools (SUSE-SU-SUSE-RU-2025:0791-1)

The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-SUSE-RU-2025:0791-1 advisory. ansible: - Security issues fixed: CVE-2024-8775: Fixed issue where sensitive information stored in Ansible Vault files could be...

Unmasking the new persistent attacks on Japan

Cisco Talos discovered malicious activities conducted by an unknown attacker since as early as January 2025, predominantly targeting organizations in Japan. The attacker has exploited the vulnerability CVE-2024-4577, a remote code execution RCE flaw in the PHP-CGI implementation of PHP on Windows...

Important: libpq

Issue Overview: Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral, PQescapeIdentifier, PQescapeString, and PQescapeStringConn allows a database input provider to achieve SQL injection in certain usage patterns. Specifically, SQL injection requires the...

Linux Distros Unpatched Vulnerability : CVE-2024-49974

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: NFSD: Limit the number of concurrent async COPY operations Nothing appears to limit the numb...

Linux Distros Unpatched Vulnerability : CVE-2024-50060

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: iouring: check if we need to reschedule during overflow flush In terms of normal application...