CVE-2025-53773

CVE-2025-53773 describes a command-injection-based remote code execution risk in GitHub Copilot and Visual Studio. The root cause is improper neutralization of elements in prompts/config that Copilot can read and act on, potentially allowing an attacker to cause Copilot to modify project configur...

Exploit for Path Traversal in Rarlab Winrar

WinRAR-CVE-2025-8088-PoC-RAR WinRAR 0day CVE-2025-8088 PoC RA...

GitHub Copilot and Visual Studio Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

IAG: Input-Aware Backdoor Attack on VLMs for Visual Grounding

Vision-language models VLMs have shown significant advancements in tasks such as visual grounding, where they localize specific objects in images based on natural language queries and images. However, security issues in visual grounding tasks for VLMs remain underexplored, especially in the conte...

Microsoft GitHub Copilot and Visual Studio 命令注入漏洞

GitHub Copilot is an AI-driven code assistant developed by Microsoft, widely used in Visual Studio Code, Visual Studio and other development environments, providing intelligent code completion and generation services for millions of developers worldwide. Microsoft GitHub Copilot remote code...

CVE-2025-53773: Improper Neutralization of Special Elements used in a Command

Improper neutralization of special elements used in a command 'command injection' in GitHub Copilot and Visual Studio allows an unauthorized attacker to execute code locally...

KLA86588 Multiple vulnerabilities in Microsoft Developer Tools

Multiple vulnerabilities were found in Microsoft Developer Tools. Malicious users can exploit these vulnerabilities to execute arbitrary code. Below is a complete list of vulnerabilities: 1. A remote code execution vulnerability in Web Deploy can be exploited remotely to execute arbitrary code. 2...

VOIDFace: a Privacy-Preserving Multi-Network Face Recognition with Enhanced Security

Advancement of machine learning techniques, combined with the availability of large-scale datasets, has significantly improved the accuracy and efficiency of facial recognition. Modern facial recognition systems are trained using large face datasets collected from diverse individuals or public...

Generative AI for Cybersecurity of Energy Management Systems: Methods, Challenges, and Future Directions

This paper elaborates on an extensive security framework specifically designed for energy management systems EMSs, which effectively tackles the dynamic environment of cybersecurity vulnerabilities and/or system problems SPs, accomplished through the incorporation of novel methodologies. A...

Linux Distros Unpatched Vulnerability : CVE-2021-23985

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - If an attacker is able to alter specific about:config values for example malware running on the user's computer, the Devtools remote debugging feature could hav...

Malicious code in sendbird-visual-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c99c539ebeed9289f0f603fbfe2d80bc9fe35f624bbd036ad397617db3be8de2 The OpenSSF Package Analysis project identified 'sendbird-visual-test' @ 11001.0.1 npm as malicious. It is considered malicious because: - The...

MAL-2025-6804 Malicious code in sendbird-visual-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c99c539ebeed9289f0f603fbfe2d80bc9fe35f624bbd036ad397617db3be8de2 The OpenSSF Package Analysis project identified 'sendbird-visual-test' @ 11001.0.1 npm as malicious. It is considered malicious because: - The...

ROS-20250807-04

Git distributed version control system vulnerability in software development tools Microsoft Visual Studio is related to the use of an unreliable search path when spell checking of cloned repositories. Exploitation of the vulnerability could allow an attacker to execute arbitrary code when clonin...

Complete Evasion, Zero Modification: PDF Attacks on AI Text Detection

AI-generated text detectors have become essential tools for maintaining content authenticity, yet their robustness against evasion attacks remains questionable. We present PDFuzz, a novel attack that exploits the discrepancy between visual text layout and extraction order in PDF documents. Our...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses dompurify-3.2.3.tgz which is vulnerable to this CVE-2025-26791

Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses dompurify-3.2.3.tgz which is vulnerable to this CVE-2025-26791 Vulnerability Details CVEID:CVE-2025-26791 DESCRIPTION: DOMPurify before 3.2.4 has an incorrect template literal regular expression, sometimes...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses runtime-7.27.0.tgz which is vulnerable to this CVE-2025-27789

Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses runtime-7.27.0.tgz which is vulnerable to this CVE-2025-27789 Vulnerability Details CVEID:CVE-2025-27789 DESCRIPTION: Babel is a compiler for writing next generation JavaScript. When using versions of Babel...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses flask_cors-5.0.1-py3-none-any.whl which is vulnerable to this CVE-2024-6839, CVE-2024-6866 and CVE-2024-6844

Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses flaskcors-5.0.1-py3-none-any.whl which is vulnerable to this CVE-2024-6839, CVE-2024-6866 and CVE-2024-6844 Vulnerability Details CVEID:CVE-2024-6866 DESCRIPTION: corydolphin/flask-cors version 4.01 contain...

Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses jinja2-3.1.5-py3-none-any.whl which is vulnerable to this CVE-2025-27516

Summary Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses jinja2-3.1.5-py3-none-any.whl which is vulnerable to this CVE-2025-27516 Vulnerability Details CVEID:CVE-2025-27516 DESCRIPTION: Jinja is an extensible templating engine. Prior to 3.1.6, an oversight in how...

CVE-2025-8217

The Amazon Q Developer Visual Studio Code VS Code extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making ...

CVE-2025-8217

The Amazon Q Developer Visual Studio Code VS Code extension v1.84.0 contains inert, injected code designed to call the Q Developer CLI. The code executes when the extension is launched within the VS Code environment; however the injected code contains a syntax error which prevents it from making ...