Huatian Dynamic OA8000 collaborative office system has an unauthenticated path traversal vulnerability in the /OAapp/jsp/trace/ntkodownload.jsp endpoint. The vulnerability arises because the filename parameter is not properly sanitized, allowing attackers to use ../ sequences to access arbitrary files on the server. This can expose sensitive files such as the Tomcat configuration (ROOT/WEB-INF/web.xml), potentially revealing configuration details and credentials. The vulnerability was first observed being exploited on 2024-11-20. The CVSS score is 7.5, indicating high severity.
@utcp/http versions before 1.1.14 have a server-side request forgery (SSRF) vulnerability that allows attackers to bypass remote-loopback checks using a {host} placeholder. This enables remote attackers to access internal loopback services such as 127.0.0.1 on the affected agent machine by supplying crafted host arguments or registering tools via Streamable HTTP and SSE discovery.
Dell PowerStore contains a SQL Injection vulnerability that can be exploited by an authenticated attacker. Successful exploitation may lead to disclosure of stored private keys and tampering with trusted certificates, posing significant security risks.
A vulnerability in open-telemetry's JavaScript client (opentelemetry-js) versions 0.204.0 through 0.221.x causes raw query strings from incoming HTTP requests to be recorded in tracing spans without redaction. This can expose sensitive information such as signed URLs or credentials to anyone with access to tracing backends. The issue is fixed in version 0.222.0.
Nuxt development server versions from 3.5.0 up to but not including 4.6.4 can serve files from a parent directory if that directory contains a stray lockfile or workspace settings file, even if the project is not inside a git repository. This allows an attacker who can access the dev server over the network to read arbitrary files under that parent directory, such as SSH keys or cloud credentials. The issue affects only the development server and not production builds. A fix is available in @nuxt/schema 4.6.4 and nuxt 4.6.4.
A concurrency issue in rails-html-sanitizer versions prior to 1.7.2 allows cross-site scripting (XSS) via shared scrubber state during concurrent sanitize calls with differing allowlists. The vulnerability arises because the PermitScrubber instance is shared and its tags and attributes are reassigned without synchronization, causing one request's sanitizer to use another's permissive allowlist. This affects multi-threaded Ruby on Rails applications using the default sanitizer configuration. The issue is fixed in version 1.7.2.
envd versions from 0.3.38 up to but not including 1.3.6 have a vulnerability in the install.python_packages(requirements=...) function that allows reading files outside the intended build context on the host. This occurs due to a time-of-check/time-of-use (TOCTOU) race condition between symlink resolution and file opening, which was partially fixed in v1.3.5 but fully resolved in v1.3.6. An attacker able to influence build inputs and concurrently modify filesystem paths may cause envd to disclose host files within the permissions of the envd process. The vulnerability may expose information through dependency debug logs and build-step metadata but does not allow arbitrary code execution or full file disclosure.
The node-global-key-listener-v9 npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_la_huitieme_vibration_by_carlo_lucarelli_fa21i' contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, uncompromised device. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package 'dowload_ebok_can_i_let_you_go_part_3_of_3_by_cathy_glass_3ciom' contains malicious code that compromises any computer on which it is installed or run. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a separate, uncompromised device due to potential persistent malicious presence.
The npm package 'dowload_ebok_titan_by_dan_abnett_8ace4' contains malicious code that fully compromises any computer on which it is installed or run. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a separate, uncompromised machine due to the possibility of persistent malicious software.
The npm package 'dowload_ebok_the_riviera_set_by_mary_s_lovell_l7i1k' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_energy_balls_by_christal_sczebel_oybjj' contains malicious code that fully compromises any computer on which it is installed or run. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but removal alone may not eliminate all malicious components. Secrets and keys should be rotated from a different, uncompromised machine to prevent further damage.
The npm package 'dowload_ebok_massacre_a_odessa_ko_tome_1_by_alex_de_brienne_1ewma' contains malicious code that fully compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Removal of the package alone does not guarantee the elimination of all malicious software introduced by it.
The npm package 'dowload_ebok_love_and_trouble_memoirs_of_a_former_wild_girl_by_claire_dederer_4z18t' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.
The npm package 'dowload_ebok_la_gran_aventura_de_la_pequena_ranita_by_mark_lesky_dlmix' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
A regular expression denial of service (ReDoS) vulnerability exists in rails-html-sanitizer versions 1.0.3 through before 1.7.2. The vulnerability arises from a regexp used to validate href attributes in SVG reference elements, which can cause quadratic-time processing on inputs with long whitespace runs. Only Ruby versions 3.1 and earlier are affected due to their regexp engine behavior. The default configuration is not affected unless SVG reference elements and their href attributes are explicitly allowed. The issue is fixed in version 1.7.2.
An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCom and Space Battery pack with WiFi which could lead to a denial of service of the affected communication device.