6025 matches found
CVE-2026-15656
CVE-2026-15656 affects IBM Maximo Application Suite (MAS) 9.2, 9.1, and 9.0. The issue is that authorization tokens and session cookies are not marked with the Secure attribute, allowing cookies to be exposed if a user visits an http link or a site containing such a link. As described in the conn...
CVE-2026-18531 IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret
IBM Maximo Application Suite 9.2, 9.1, and 9.0 could allow a remote attacker to tamper with session data due to the use of a weak HMAC session signing secret...
No title provided
A flaw was found in axios. A remote attacker could exploit an uncontrolled recursion vulnerability in the formDataToJSON function by supplying FormData with field names containing deeply nested bracket segments. This could exhaust the JavaScript call stack, leading to a RangeError and causing a...
axios: axios: Prototype Pollution allows unauthorized data transmission and network redirection
A flaw was found in axios, a widely used JavaScript library for making web requests. This vulnerability, known as prototype pollution, allows an attacker to subtly alter how network requests are built if another part of the system has already been compromised. This could lead to an attacker...
axios: axios: Denial of Service via maxBodyLength bypass with ReadableStream
A flaw was found in axios. This vulnerability allows a remote attacker to bypass configured upload size limits by supplying unknown-length stream data when using WHATWG ReadableStream request bodies in the fetch adapter, specifically when the Content-Length cannot be determined. This can lead to...
axios: axios: NO_PROXY bypass allows exposure of local services
A flaw was found in axios. This vulnerability occurs because the software fails to correctly identify 0.0.0.0 as a local loopback address when evaluating NOPROXY rules. A remote attacker could exploit this by providing a 0.0.0.0 URL, causing requests to bypass intended proxy restrictions. This...
axios: axios: Denial of Service due to maxBodyLength bypass in HTTP/2 requests
A flaw was found in axios, a popular JavaScript library for making HTTP requests. When using the Node.js HTTP/2 adapter, axios fails to properly enforce the configured maxBodyLength limit for streamed request bodies. This allows a remote attacker, by controlling the input stream, to send an...
axios: axios: Outbound Request Tampering via Prototype Pollution in Basic Auth
A flaw was found in axios. This vulnerability involves prototype pollution read-side gadgets within the basic authentication subfield handling. If an application is already susceptible to a separate prototype pollution issue and makes an axios request without specifying username or password in it...
MAL-2026-12349 Malicious code in chai-assertions-plus (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 80a83cd9353779d12538e8c6b06276178f6f0c246abd7d5148ce805536cbf57f The package is published as a Chai assertions extension, but the shipped code in index.js and lib/ is unrelated Pino logger source used as filler...
SUSE CVE-2026-67312
axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDataToJSON exposed as axios.formToJSON and used internally when serializing FormData with Content-Type: application/json. When an application passes attacker-controlled FormData field names...
Linux Distros Unpatched Vulnerability : CVE-2026-67318
"The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios versions =1.13.0 Node.js HTTP adapter fail to enforce the configured maxBodyLength limit on streamed request bodies when requests are sent with...
Linux Distros Unpatched Vulnerability : CVE-2026-67315
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0...
Linux Distros Unpatched Vulnerability : CVE-2026-67314
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios versions =1.15.2 and 1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handling lib/adapters/http.js and...
Information Disclosure axios Dependency in Jira Software Data Center
This High severity Information Disclosure vulnerability was introduced in versions 10.3.22 and 11.3.7 of Jira Software Data Center. This Information Disclosure vulnerability, with a CVSS Score of 8.3 and a CVSS Vector of CVSS:4.0/AV:N/AC:L/AT: P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N allows an...
CLSA-2026-1785380888 TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.18.1-tuxcare.4...
CLSA-2026-1785467924 TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.15.3-tuxcare.6...
CLSA-2026-1785468080 TuxCare security update for axios (15 CVEs)
TuxCare rebuilt axios to address 15 CVEs. Fixed in 0.26.0-tuxcare.4...
CLSA-2026-1785291680 TuxCare security update for axios (1 CVE)
TuxCare rebuilt axios to address 1 CVE. Fixed in 0.33.0-tuxcare.3...