CVE-2021-25392

Improper protection of backup path configuration in Samsung Dex prior to SMR MAY-2021 Release 1 allows local attackers to get sensitive information via changing the path...

CVE-2020-13838

An issue was discovered on Samsung mobile devices with P9.0 and Q10.0 software. The DeX Lockscreen feature does not block access to Quick Panel and notifications. The Samsung ID is SVE-2020-17187 June 2020...

CVE-2018-21048

An issue was discovered on Samsung mobile devices with O8.x software. There is a Notification leak on a locked device in Standalone Dex mode. The Samsung ID is SVE-2018-12925 November 2018...

CVE-2017-9520

The rconfigset function in libr/config/config.c in radare2 1.5.0 allows remote attackers to cause a denial of service use-after-free and application crash via a crafted DEX file...

CVE-2018-21082

An issue was discovered on Samsung mobile devices with N7.x software. Dex Station allows App Pinning bypass and lock-screen bypass via the "Use screen lock type to unpin" option. The Samsung ID is SVE-2017-11106 February 2018...

Moneros Decentralized P2P Exchanges: Functionality, Adoption, and Privacy Risks

Privacy-focused cryptocurrencies like Monero remain popular, despite increasing regulatory scrutiny that has led to their delisting from major centralized exchanges. The latter also explains the recent popularity of decentralized exchanges DEXs with no centralized ownership structures. These...

Malicious code in ecko-dex-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d26b6d8be6f7dbf592bade371103317c029f4297df9557c79997a41d18e2c3c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2755 Malicious code in ecko-dex-react (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d26b6d8be6f7dbf592bade371103317c029f4297df9557c79997a41d18e2c3c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-FGQ5-Q76C-GX78 vulnerabilities

Vulnerabilities for packages: skaffold, kubernetes-dashboard-metrics-scraper, caddy, ip-masq-agent, http-echo, prometheus-adapter, gomplate, nri-prometheus, govulncheck, scorecard, ytt, vexctl, docker-credential-gcr, pulumi-language-yaml, kubevela, capslock, nuclei, docker-cli, nri-nginx,...

Malicious code in dex-api-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cebe6e3901a157f586d6d5418f0a6995bf4d085c63acd7730784b55b744e65a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2020-26290

Dex is a federated OpenID Connect provider written in Go. In Dex before version 2.27.0 there is a critical set of vulnerabilities which impacts users leveraging the SAML connector. The vulnerabilities enables potential signature bypass due to issues with XML encoding in the underlying Go library...

Signature Bypass

github.com/dexidp/dex is vulnerable to Signature Bypass. The vulnerability is due to issues with XML encoding in the underlying Go library by using the xml-roundtrip-validator from Mattermost, which allows an attacker to bypass the signature verification process in SAML assertions...

Malicious code in hts-open-dex-react-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 71bfac5a5597cde45524360e887ab5bed0c9e5b8c5337ac9c0728b677529de56 The OpenSSF Package Analysis project identified 'hts-open-dex-react-ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in serum-dex-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23e693f28915ad1c0bf05e8f5e0e1cab49a329f00b7f27303d08ec76d8ab068f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12038 Malicious code in serum-dex-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 23e693f28915ad1c0bf05e8f5e0e1cab49a329f00b7f27303d08ec76d8ab068f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-V778-237X-GJRC vulnerabilities

Vulnerabilities for packages: docker-cli-buildx, octo-sts, rook, skaffold, prometheus-adapter, caddy, vault-benchmark, pulumi-language-dotnet, kube-fluentd-operator, gomplate, kapp-controller, crossplane-provider-aws-sns, crossplane-provider-azure-authorization, go-discover,...

CVE-2024-49414

Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list...

CVE-2024-49414

Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list...

CVE-2024-49414

Authentication Bypass Using an Alternate Path in Dex Mode prior to SMR Dec-2024 Release 1 allows physical attackers to temporarily access to recent app list...

CVE-2024-49414

Samsung mobile devices with Dex Mode prior to SMR Dec-2024 Release 1 are affected by an authentication bypass via an alternate path that can allow a physical attacker to temporarily access the device’s recent app list. The issue stems from an insecure authentication flow in Dex Mode, per the CVE-...