8093 matches found
IKEA information leakage vulnerability
IKEA is a well-known furniture retail brand from Sweden by the Dutch company IKEA. It offers a wide range of home products and food products to fulfill life's needs. A security vulnerability exists in IKEA version 4.13.0 that originates from a specially crafted link that can access sensitive user...
MUCFC Merchants Union Finance security vulnerability
MUCFC Merchants Union Finance MUCFC is a credit loan installment borrowing platform from China Merchants Union MUCFC Corporation. A security vulnerability exists in MUCFC Merchants Union Finance iOS version 6.19.0, which originates from a specially crafted link that can access sensitive user...
Boohee Health security vulnerabilities
Boohee Health 薄荷健康 is a weight loss and fitness light fasting management software from the Chinese company Boohee. A security vulnerability exists in Boohee Health version 13.0.13, which originates from a specially crafted link that can access sensitive user information...
51Job security vulnerabilities
51Job is a job site from China's MileagePlus 51Job company. A security vulnerability exists in 51Job version 14.22.0, which originates from a specially crafted link that can access sensitive user information...
Suning EMall security vulnerability
Suning EMall is an integrated online shopping platform of China-based Suning Ebay Suning Inc. A security vulnerability exists in Suning EMall iOS version 9.5.198, which originates from a specially crafted link that can access sensitive user information...
AiShanDong security vulnerabilities
AiShanDong 爱山东 is an application mall system from the Chinese company AiShanDong 爱山东. A security vulnerability exists in AiShanDong version 5.0.0, which originates from a specially crafted link that can access sensitive user information...
YuPao DirectHire security vulnerabilities
YuPao DirectHire is a recruiting software from the Chinese company YuPao 鱼泡. A security vulnerability exists in YuPao DirectHire version 8.8.0, which originates from a specially crafted link that can access sensitive user information...
PYSEC-2025-3 When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.
Published in 2019, the autodzee package is a Python library that bypasses Deezer API restrictions to download music. The package was found to exfiltrate user data to a hardcoded server, which could be used for malicious purposes...
PYSEC-2025-4 When using the project to bypass Deezer API restrictions, project exfiltrates user data to a hardcoded server.
Published in 2019, the automslc package is a Python library that bypasses Deezer API restrictions to download music. The package was found to exfiltrate user data to a hardcoded server, which could be used for malicious purposes...
MSC-2025-2093
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Suspect publisher – this publisher has a history ...
CVE-2025-22881
CVE-2025-22881 affects Delta Electronics CNCSoft-G2, a human-machine interface (HMI) software. The vulnerability is a heap-based buffer overflow caused by insufficient validation of the length of user-supplied data before copying to a fixed-length heap buffer. An attacker can lure a target to vis...
GHSA-QCM9-87FM-RGPF vulnerabilities
Vulnerabilities for packages: mysql...
CVE-2024-13494
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data...
CVE-2024-13494
CVE-2024-13494 : The WordPress File Upload plugin (WordPress File Upload) is vulnerable to Cross-Site Forgery (CSRF) in all versions through 4.25.2 due to missing/incorrect nonce validation in the wfu_file_details function. An unauthenticated attacker could modify details of uploaded files by tri...
CVE-2024-13494 WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data...
CVE-2024-13494 WordPress File Upload <= 4.25.2 - Cross-Site Request Forgery in wfu_file_details
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data...
CVE-2024-13494: Cross-Site Request Forgery (CSRF)
The WordPress File Upload plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 4.25.2. This is due to missing or incorrect nonce validation on the 'wfufiledetails' function. This makes it possible for unauthenticated attackers to modify user data...
MSC-2025-2038
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Exfiltrating sensitive private user information –...
A week in security (February 17 – February 23)
Last week on Malwarebytes Labs: Healthcare security lapses keep piling up SecTopRAT bundled in Chrome installer distributed via Google Ads Google Docs used by infostealer ACRStealer as part of attack DeepSeek found to be sharing user data with TikTok parent company ByteDance Malwarebytes introduc...
CVE-2020-6158
Opera Mini for Android before version 52.2 is vulnerable to an address bar spoofing attack. The vulnerability allows a malicious page to trick the browser into showing an address of a different page. This may allow the malicious page to impersonate another page and trick a user into providing...