Magento-APSB22-48-Security-Patches

Official Magento Patches have been released:Magento Docs These patches address the same security issues as this repository does. Except that we've added a few fixes to older Magento versions. Security patches for APSB22-48 This repository contains Magento 2 Patch Files for the recently found...

ip-address: no classifier recognizes the NAT64 local-use range 64:ff9b:1::/48, allowing SSRF and trust-boundary bypass

Summary No classifier on Address6 recognizes the NAT64 local-use range 64:ff9b:1::/48 RFC 8215. isPrivate, isLoopback, isLinkLocal and their siblings all return false for every address in it, so an internal IPv4 destination written through a local-use NAT64 prefix 64:ff9b:1:7f00:0:100:: for...

Server-side Request Forgery (SSRF)

Overview org.webjars.npm:ip-address is an A library for parsing IPv4 and IPv6 IP addresses in node and the browser. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via isPrivate in src/ipv6.ts, which fails to classify addresses in the RFC 8215 NAT64 local-use...

PT-2026-99953

Name of the Vulnerable Software and Affected Versions ip-address versions 10.2.0 through 10.5.0 Description The Address6.isPrivate classifier in src/ipv6.ts fails to recognize the NAT64 local-use range 64:ff9b:1::/48. Consequently, the isPrivate, isLoopback, and isLinkLocal functions return false...

EulerOS Virtualization 2.11.0 : libpcap (EulerOS-SA-2026-3516)

According to the versions of the libpcap package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : pcapetheraton is an auxiliary function in libpcap, it takes a string argument and returns a fixed-size allocated buffer. The string...

Malicious code in lia-48 (npm)

Source: amazon-inspector 5e68766097a1361697be6d5fbc2c13a71b7a79845abe17e395e6bdd164d20bee This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in kentung-48 (npm)

Source: amazon-inspector 5edf356c7774f05a5d79b7073c8e5ed781eceede2586341ba9e7588c4bdc9896 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ita-48 (npm)

Source: amazon-inspector eec236eba98fcb15bd96455018fb12828fe5de88f3f6f8cefeea6e75dd78ac0c This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ira-48 (npm)

Source: amazon-inspector d8c961134f93a9fff8dcbe1ddc1320f345b5071ddd5082b035fbe23b6a5ff5fe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in intan-48 (npm)

Source: amazon-inspector 68b6e59964e54b6f30324c06edaea3deea37e5b41b146b4003d614ab3d7eaa5b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in implicit_toad_peach-48 (npm)

Source: amazon-inspector bb0ae99a9b07376a648fb7b0e6fa79b1cd6a9798677aa628cf3db8fd7e0daacf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ilop-48 (npm)

Source: amazon-inspector 1f55727be591444bbdf1b8f6d1fcbd7a6d4d60375f029fde78acb85bca428abe This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in ilang-48 (npm)

Source: amazon-inspector f6b9888ec98247c750120bde6faf81187bb5a379c5798a05933c223702118d16 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in icha-48 (npm)

Source: amazon-inspector 4d2a8fb38af5898ed4d194f72a8e4dcdc18a741b967e500859e7636116878e40 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hokage-48 (npm)

Source: amazon-inspector f5ea43064999a8dc1cd56f256e8cb7380a2aae83184030fae3ed0ef6a4fbeeae This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in hafiz-48 (npm)

Source: amazon-inspector 81c4f7f89517f8a744bbb82594d554d248e9580227f49b2fa02003e73766ac3d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in exciting_reindeer_maroon-48 (npm)

Source: amazon-inspector b20ba6a0945c706c17c8f760319cf405594d940c6375b9bf33b7a162c55747b8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in dia-48 (npm)

Source: amazon-inspector b135a60d795b28d289dbaa7aa9784382e965bea841d7c65659d67dc281ee470a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in continuous_tuna_salmon-48 (npm)

Source: amazon-inspector 1cd0968cddbe8b84877400e7c82d19ad4bd0057611e8933433f8ac89c3e30035 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in cinta-48 (npm)

Source: amazon-inspector 33ddc12f36c4fbd9827d484bfdf92b510a2e05abf5e8f7dfae571e636d4a9f98 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...