(Pwn2Own) QNAP TS-464 Improper Handling of URL Encoding Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the function responsible for URL decoding. The issue results from improper...

(Pwn2Own) QNAP TS-464 Active Directory Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Active Directory integration. The issue results from the improper...

(Pwn2Own) QNAP TS-464 reset_password.cgi Improper Certificate Validation Information Disclosure Vulnerability

This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetpassword.cgi endpoint. The issue results from the lack of...

(Pwn2Own) QNAP TS-464 reset_password.cgi Improper Certificate Validation Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetpassword.cgi endpoint. The issue results from the lack of proper...

(Pwn2Own) QNAP TS-464 Samba Command Argument Injection Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of QNAP TS-464 devices. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of the provided username during authentication. The issue...

(Pwn2Own) QNAP TS-464 qnap_exec Command Injection Privilege Escalation Vulnerability

This vulnerability allows remote attackers to escalate privileges on affected installations of QNAP TS-464 devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the qnapexec function. The...

(Pwn2Own) QNAP TS-464 reset_password.cgi Hard-coded Cryptographic Key Authentication Bypass Vulnerability

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of QNAP TS-464. Authentication is not required to exploit this vulnerability. The specific flaw exists within the resetpassword.cgi endpoint. The issue results from the use of a hard-coded...

(Pwn2Own) QNAP TS-464 privWizard.cgi Authentication CRLF Injection Privilege Escalation Vulnerability

This vulnerability allows network-adjacent attackers to escalate privileges on affected installations of QNAP TS-464 devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the privWizard.cg...

PT-2025-31823 · Gnu +1 · Gpac +1

Уязвимость функции m2tsdmx send packet утилиты MP4Box мультимедийной платформы GPAC связана с переполнением буфера в куче при обработке TS-файлов. Эксплуатация уязвимости может позволить нарушителю выполнить произвольный код при открытии специально сформированного файла...

Malicious code in ts-browser-webpack (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d8417c8eb33f6d78a0b4c28cf081096fc75806bc0795e4327cc6792414ee266 The OpenSSF Package Analysis project identified 'ts-browser-webpack' ...

MAL-2025-6132 Malicious code in ts-browser-webpack (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1d8417c8eb33f6d78a0b4c28cf081096fc75806bc0795e4327cc6792414ee266 The OpenSSF Package Analysis project identified 'ts-browser-webpack' ...

MAL-2025-6108 Malicious code in node-ts-esm-auto (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...

@altipla/directus-sdk-utils (=0.7.2), @bicou/directus-extension-imagga (>=1.6.3 <=1.6.6) +9 more potentially affected by CVE-2025-53889 via directus (>=10.10.0 <=11.8.0)

directus NPM version =10.10.0, =1.6.3, =11.16.1-depup.0, =15.0.0, =1.2.2, =1.0.0, =2.0.0 - directus-extension-blog-year-filter =1.0.0 - lease-directus-template =0.0.0 Source cves: CVE-2025-53889 Source advisory: OSV:GHSA-7CVF-PXGP-42FC...

Malicious code in ts-immutable-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8973314ba8fa2b03657d72c713210715041e6b5afbf03cacf105e886ab18c68c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-5963 Malicious code in ts-immutable-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8973314ba8fa2b03657d72c713210715041e6b5afbf03cacf105e886ab18c68c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6107 Malicious code in node-ts-cjs-auto (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in node-ts-cjs-auto (npm)

The package communicates with a domain associated with malicious activity...

Malicious code in vite-tsauditlog (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 830e528439887027d65ed0697132b3f91dc2b11e553dc12671446d5f6eea1b2f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in nordic-dev-ts (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1745e8aa07b56cf04bc594aa60fb250b98666d7c3c65514c610e4e55b39ec70f Any computer that has this package installed or running should be considered...

MAL-2025-5312 Malicious code in nordic-dev-ts (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1745e8aa07b56cf04bc594aa60fb250b98666d7c3c65514c610e4e55b39ec70f Any computer that has this package installed or running should be considered...