1751 matches found
CVE-2025-34133
Wimi Teamwork versions prior to 7.38.17 contains a cross-site request forgery CSRF vulnerability in its API. The API accepts any authenticated request that contains a JSON field named 'csrftoken' without validating the field’s value; only the presence of the field is checked. An attacker can craf...
CVE-2025-36121 HTML Injection Vulnerability in a Specific URL Endpoint of the IBM OpenPages Application
IBM OpenPages 9.1 and 9.0 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...
PT-2025-43971
Name of the Vulnerable Software and Affected Versions Wimi Teamwork versions prior to 7.38.17 Description The software contains a cross-site request forgery CSRF issue in its API. The API accepts authenticated requests containing a JSON field named csrf token without validating its value, only...
EUVD-2025-35691
Cross site request forgery CSRF vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim to open page with exploit...
CVE-2025-56009
CVE-2025-56009 affects KeeneticOS prior to 4.3. A CSRF flaw at the /rci API endpoint lets an attacker cause a victim to add a new user with full permissions, effectively allowing device takeover. The CVE description and Red Hat/CNNVD/CVE records confirm the vulnerability path is the /rci API, wit...
CVE-2025-56009
Cross site request forgery CSRF vulnerability in KeeneticOS before 4.3 at "/rci" API endpoint allows attackers to take over the device via adding additional users with full permissions by managing the victim to open page with exploit...
PYSEC-2025-187
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been...
EUVD-2025-35097
Taguette is an open source qualitative research tool. An issue has been discovered in Taguette versions prior to 1.5.0. It was possible for an attacker to request password reset email containing a malicious link, allowing the attacker to set the email if clicked by the victim. This issue has been...
Ransomware attacks and how victims respond
Welcome to this week's edition of the Threat Source newsletter. I count myself fortunate that I have never been on the receiving end of a ransomware attack. My experiences have been from research and response, never as a victim. It's a tough scenario: One day you are working or minding your own...
CVE-2025-54266 Adobe Commerce | Cross-site Scripting (Stored XSS) (CWE-79)
Adobe Commerce versions 2.4.9-alpha2, 2.4.8-p2, 2.4.7-p7, 2.4.6-p12, 2.4.5-p14, 2.4.4-p15 and earlier are affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript ma...
CVE-2025-42901
CVE-2025-42901 affects SAP Application Server for ABAP (BAPI Explorer) where an authenticated attacker can store malicious JavaScript payloads that execute in the victim’s browser. Impact is described as low for confidentiality and integrity, with no availability impact. Root cause involves store...
CVE-2025-59991 Junos Space: Device Management pages are vulnerable to reflected cross-site script injection
An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Juniper Networks Junos Space allows an attacker to inject script tags in the Device Management pages that, when visited by another user, enable the attacker to execute commands with the target's...
PT-2025-41437
Name of the Vulnerable Software and Affected Versions Juniper Networks Junos Space versions prior to 24.1R4 Description An Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' issue exists in Juniper Networks Junos Space. An attacker can inject script tags in the...
Cyber Slavery Infrastructures: A Socio-Technical Study of Forced Criminality in Transnational Cybercrime
The rise of "cyber slavery," a technologically facilitated variant of forced criminality, signifies a concerning convergence of human trafficking and digital exploitation. In Southeast Asia, trafficked individuals are increasingly coerced into engaging in cybercrimes, including online fraud and...
EUVD-2018-12083
Malware in sbrugna...
EUVD-2018-0005
Malware in sbrugna...
EUVD-2020-26267
Malware in sbrugna...
EUVD-2018-8306
Malware in sbrugna...