31026 matches found
CVE-2026-101905
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.2 until 1.20.0, the Node HTTP adapter in lib/adapters/http.js supplies request options without an own createConnection value. A separate same-process prototype-pollution flaw places a function on...
MGASA-2026-0458 Updated php package fixes security vulnerabilities
FILTERSANITIZEENCODED does not encode 0xFF IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison Various packet overreads in mysqlnd wire protocol TLS hostname verification falls back to CN after SAN mismatch Heap buffer overflow in phpopensslmatcheswildcardname on...
Updated php package fixes security vulnerabilities
FILTERSANITIZEENCODED does not encode 0xFF IPv6 ACL bypass in FastCGI listen.allowedclients due to partial address comparison Various packet overreads in mysqlnd wire protocol TLS hostname verification falls back to CN after SAN mismatch Heap buffer overflow in phpopensslmatcheswildcardname on...
Malicious code in fabric-asset-pipeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...
MAL-2026-17224 Malicious code in fabric-asset-pipeline (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bb92787d766d5bfa0c384cc04909689215fa0d3e869630422caa8bedd303038a [email protected] declares a postinstall hook that runs index.js on npm install. index.js is heavily obfuscated obfuscator.io-style rotated...
CVE-2026-88805
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...
CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...
CVE-2026-88805
In SUSE Rancher versions 2.15 before 2.15.2 , a vulnerability exists where incorrect credential cleaning occurs during the logout process. This flaw allows remote attackers to maintain access credentials even after an account has been logged out. The CVSS v3.1 score is 8.1 (HIGH) , indicating a h...
CVE-2026-88805 Session Not Revoked Server-Side on Logout in Rancher
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...
EUVD-2026-88339
Incorrect credential cleaning on logout could be used by remote attackers to keep access credentials even after the account was logged out. Affected is SUSE Rancher 2.15 before 2.15.2...
The Developer is the New Perimeter: How Supply Chain Attacks Are Becoming Cloud Breaches
Key Takeaways Malicious packages can steal cloud credentials during installation, before applications run. Stolen credentials turn developer workstations and CI/CD pipelines into gateways to cloud resources. Restrict installation scripts, minimize credential privileges, protect metadata access, a...
CVE-2017-8225-EXPLOIT
CVE-2017-8225 - GoAhead System.ini の情報漏えい この脆弱性は、Wireless IP Camera P2P WIFICAM デバイスに関連します。重要な認証情報を格納する .ini ファイルの検証が正しく行われないことに起因します。熟練した攻撃者は、URI 内の loginuse および loginpas パラメータの両方に空の値を指定することで、この脆弱性を悪用できます。具体的には、パス /system.ini?loginuse&loginpas を介してアクセスが許可されます。 エクスプロイトの詳細...
CVE-2018-9995-EXPLOIT
CVE-2018-9995 - DVR認証バイパス このリポジトリは、CVE-2018-9995として識別されるセキュリティ脆弱性に対処するものです。この脆弱性は、TBK DVR4104、DVR4216、Novo、CeNova、QSee、Pulnix、XVR 5 in 1、Securus、Night OWL、DVR Login、HVR Login、MDVR Loginなど、さまざまなDVRデバイスに影響を及ぼします。これらのデバイスは、元のTBK...
CVE-2026-82933
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...
CVE-2026-82929
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...
CVE-2026-82933 Cleartext Transmission of Sensitive Information in mH-DEVELOPER
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...
CVE-2026-82933
The mH-DEVELOPER smart home module is vulnerable to cleartext transmission of sensitive information because it sends web interface and API traffic over unencrypted HTTP . This allows an attacker on the same network to intercept passwords , authentication tokens , and device commands , potentially...
EUVD-2026-88232
mH-DEVELOPER smart home module sends its web interface and API traffic over unencrypted HTTP. Passwords, authentication tokens, and device commands are transmitted in cleartext. An attacker on the same network can intercept this traffic, steal credentials and tokens, and hijack sessions. This iss...
CVE-2026-82929
The mH-DEVELOPER smart home module is vulnerable because it uses identical hard-coded SSH host keys across all devices instead of generating unique per-device keys. An attacker capable of extracting these keys from the firmware can deploy a rogue SSH server that clients will trust automatically. ...
EUVD-2026-88229
mH-DEVELOPER smart home module uses the same hard-coded SSH host keys on every device, with no per-device key generation. An attacker who extracts these keys from the firmware can set up a rogue SSH server that clients will trust without warning, enabling man-in-the-middle attacks and credential...