41 matches found
CVE-2026-26080
HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected...
CVE-2026-26081
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...
CVE-2026-26081
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...
EUVD-2026-45988
HAProxy Community Edition 3.2.x through 3.3.x before 3.3.3 can enter a loop or crash because varint is mishandled. HAProxy Enterprise and ALOHA are also affected...
EUVD-2026-45989
HAProxy Community Edition 3.0 through 3.3 before 3.3.3 lacks a length check for the NEWTOKEN format. HAProxy Enterprise and ALOHA are also affected...
CVE-2026-26081
CVE-2026-26081 affects HAProxy Community Edition 3.0–3.3 prior to 3.3.3 and HAProxy Enterprise/ALOHA. The issue is a missing length check in the NEW_TOKEN format, enabling a potential denial-of-service condition. The CVSS base score is 4.8 (Medium) with network attack vector, high complexity, no ...
CVE-2026-26080
HAProxy vulnerability CVE-2026-26080 affects HAProxy Community Edition 3.2.x–3.3.x prior to 3.3.3; HAProxy Enterprise and ALOHA are affected. Root cause: mishandling of varint can cause a loop or crash, leading to DoS. Remediation: upgrade to 3.3.3 or newer (openSUSE/SUSE advisories also referenc...
📄 NCR Command Center Agent 16.3 Remote Code Execution
CMCAgent in NCR Command Center Agent version 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021...
EUVD-2014-6659
Malware in sbrugna...
EUVD-2014-6690
Malware in sbrugna...
EUVD-2014-7204
Malware in sbrugna...
EUVD-2014-7188
Malware in sbrugna...
Malicious code in test-mlw2-aloha-miner (npm)
The package test-mlw2-aloha-miner was found to contain malicious code...
MAL-2025-34866 Malicious code in test-mlw2-aloha-miner (npm)
The package test-mlw2-aloha-miner was found to contain malicious code...
alohatravel.cz Cross Site Scripting vulnerability OBB-3895712
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
aloha-sd (>=1.0.0 <=1.0.7) potentially affected by CVE-2021-23386 via dns-packet (=1.1.1)
dns-packet NPM version =1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dns-packet and may be impacted: - aloha-sd =1.0.0, =1.0.7 Source cves: CVE-2021-23386 Source advisory: OSV:GHSA-3WCQ-X3MQ-6R9P...
aloha-sd (>=1.0.0 <=1.0.7) potentially affected by CVE-2021-23386 via dns-packet (=1.1.1)
dns-packet NPM version =1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on dns-packet and may be impacted: - aloha-sd =1.0.0, =1.0.7 Source cves: CVE-2021-23386 Source advisory: SNYK:JS-DNSPACKET-1293563...
Design/Logic Flaw
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
CVE-2021-3122
CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...
CVE-2021-3122
CVE-2021-3122 affects NCR Command Center Agent 16.3 on Aloha POS/BOH servers. The CMCAgent processes a runCommand parameter inside an XML document sent to port 8089, enabling remote unauthenticated execution of arbitrary commands as SYSTEM. Exploitation in the wild reported in 2020–2021. Vendor n...