Aggregator

CVE-2024-12604 | Tapandsign Tap&Sign App prior 1.025 Environment Variable exposure of sensitive information through environmental variables

Vuldb Updates
4 weeks 1 day ago
A vulnerability categorized as critical has been discovered in Tapandsign Tap&Sign App. This affects an unknown function of the component Environment Variable Handler. The manipulation results in exposure of sensitive information through environmental variables. This vulnerability is identified as CVE-2024-12604. The attack can be executed remotely. There is not any exploit available. This product is available as a managed service. Users are not able to maintain vulnerability countermeasures themselves. It is advisable to upgrade the affected component.
vuldb.com

CVE-2025-1301 | Yordam Informatics Library Automation System up to 21.5 cross site scripting

Vuldb Updates
4 weeks 1 day ago
A vulnerability was found in Yordam Informatics Library Automation System up to 21.5. It has been declared as problematic. Impacted is an unknown function. Executing manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2025-1301. It is possible to launch the attack remotely. No exploit is available. It is recommended to upgrade the affected component.
vuldb.com

核心API未授权监控

迪哥讲事
4 weeks 1 day ago
一个人的安全，总会有点力不从心，又不能完全信任业务能做到安全，说不得此时此刻没有安全问题，保不准哪一波更新就

UK train operator LNER (London North Eastern Railway) discloses a data breach

Security Affairs
4 weeks 1 day ago
LNER warns of a data breach via a third-party supplier, exposing customer contact details and other personal information. UK train operator LNER (London North Eastern Railway) reported a data breach through a third-party supplier, compromising customer contact details and other personal information. LNER (London North Eastern Railway) is a British train operator running passenger services […]
Pierluigi Paganini

Malware Campaign Uses SVG Email Attachments to Deploy XWorm and Remcos RAT

GBHackers on Security | #1 Globally Trusted Cyber Security News Platform
4 weeks 1 day ago

Recent threat campaigns have revealed an evolving use of BAT-based loaders to deliver Remote Access Trojans (RATs), including XWorm and Remcos. These campaigns typically begin with a ZIP archive—often hosted on seemingly legitimate platforms such as ImgKit—designed to entice user interaction by mimicking benign content. Once opened, the archive unpacks a highly obfuscated BAT script […]

The post Malware Campaign Uses SVG Email Attachments to Deploy XWorm and Remcos RAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform.

Mayura Kathir

CVE-2025-7337 | GitLab Community Edition/Enterprise Edition up to 18.1.5/18.2.5/18.3.1 allocation of resources (Patch 554062 / EUVD-2025-29022)

Vuldb Updates
4 weeks 1 day ago
A vulnerability, which was classified as problematic, has been found in GitLab Community Edition and Enterprise Edition up to 18.1.5/18.2.5/18.3.1. The impacted element is an unknown function. This manipulation causes allocation of resources. This vulnerability is tracked as CVE-2025-7337. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.
vuldb.com

CVE-2025-10340 | WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3 Commit Message change_log.php cross site scripting (EUVD-2025-29089)

VulDB Recent Entries
4 weeks 1 day ago
A vulnerability categorized as problematic has been discovered in WhatCD Gazelle up to 63b337026d49b5cf63ce4be20fdabdc880112fa3. The affected element is an unknown function of the file /sections/tools/managers/change_log.php of the component Commit Message Handler. Executing manipulation of the argument Message can lead to cross site scripting. This vulnerability appears as CVE-2025-10340. The attack may be performed from remote. In addition, an exploit is available. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed.
vuldb.com

Addressing CISA Advisory on Rockwell Automation ThinManager SSRF Vulnerability (CVE-2025-9065)

Security Boulevard
4 weeks 1 day ago

Critical Security Alert: If you are an organization using Rockwell’s ThinManager software version 13.0 or below, you are vulnerable. If you cannot upgrade immediately, please scroll to the section on compensating controls below and contact our team without delay. On September 9, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a critical advisory […]

The post Addressing CISA Advisory on Rockwell Automation ThinManager SSRF Vulnerability (CVE-2025-9065) appeared first on ColorTokens.

The post Addressing CISA Advisory on Rockwell Automation ThinManager SSRF Vulnerability (CVE-2025-9065) appeared first on Security Boulevard.

Agnidipta Sarkar

CVE-2025-29496 | libming 0.4.8 SWF File decompileDUPLICATECLIP memory corruption (Issue 330 / EUVD-2025-8448)

Vuldb Updates
4 weeks 1 day ago
A vulnerability, which was classified as critical, has been found in libming 0.4.8. This impacts the function decompileDUPLICATECLIP of the component SWF File Handler. The manipulation leads to memory corruption. This vulnerability is listed as CVE-2025-29496. The attack must be carried out from within the local network. In addition, an exploit is available.
vuldb.com

CVE-2025-4922 | HashiCorp Nomad/Nomad Enterprise up to 1.10.1 Prefix-based ACL Policy Lookup privileges assignment (Nessus ID 264362)

Vuldb Updates
4 weeks 1 day ago
A vulnerability has been found in HashiCorp Nomad and Nomad Enterprise up to 1.10.1 and classified as critical. Affected by this vulnerability is an unknown functionality of the component Prefix-based ACL Policy Lookup. This manipulation causes incorrect privilege assignment. This vulnerability is handled as CVE-2025-4922. The attack can be initiated remotely. There is not any exploit available. The affected component should be upgraded.
vuldb.com

CVE-2020-36732 | crypto-js up to 3.2.0 on Node.js entropy (Issue 254 / EUVD-2023-1673)

Vuldb Updates
4 weeks 1 day ago
A vulnerability was found in crypto-js up to 3.2.0 on Node.js. It has been classified as problematic. The affected element is an unknown function. The manipulation leads to insufficient entropy in prng. This vulnerability is referenced as CVE-2020-36732. The attack needs to be initiated within the local network. No exploit is available. Upgrading the affected component is recommended.
vuldb.com

Managed ad