444 matches found
@lblod/ember-rdfa-editor (>=12.4.0-dev.1f5a5b71099288ff594f4d5de652b8af64917693 <=13.10.2) potentially affected by unknown CVE via ember-headless-form (=1.1.1)
ember-headless-form NPM version =1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on ember-headless-form and may be impacted: - @lblod/ember-rdfa-editor =12.4.0-dev.1f5a5b71099288ff594f4d5de652b8af64917693, =13.10.2 Source cves: unknown CVE Source...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...
Embedded Malicious Code
Overview Affected versions of this package are vulnerable to Embedded Malicious Code. Compromised versions of this package contain a file called bundle.js that exfiltrates secrets from the user's accounts, including credentials and API tokens. It also downloads malicious files and repackages them...
Incorrect Authorization
Overview Affected versions of this package are vulnerable to Incorrect Authorization via the API Builder. An attacker can access sensitive object entry information by sending unauthorized requests as a guest user. Remediation Upgrade com.liferay:com.liferay.headless.builder.impl to version 1.0.32...
Timing Attack
Overview Affected versions of this package are vulnerable to Timing Attack via the WorkflowException error messages. An attacker can infer the existence of ERC by measuring differences in response times. Remediation Upgrade com.liferay:com.liferay.headless.admin.workflow.impl to version 5.0.83 or...
Payload 代码问题漏洞
Payload is a Headless CMS and application framework built using TypeScript, Node.js, React, and MongoDB. Payload has a code issue vulnerability that stems from JWT not being invalidated after logout, which could lead to token reuse...
Payload 授权问题漏洞
Payload is a Headless CMS and application framework built using TypeScript, Node.js, React, and MongoDB. Payload suffers from an authorization issue vulnerability that stems from SQLite adapters reusing identifiers during account creation, which could lead to a session fixation attack...
Cross-site Request Forgery (CSRF)
Overview Affected versions of this package are vulnerable to Cross-site Request Forgery CSRF via the endpoint parameter. An attacker can perform unauthorized actions on behalf of an authenticated user by tricking the user into visiting a malicious website that issues crafted requests. Remediation...
Malicious code in hathor-wallet-headless (npm)
The package hathor-wallet-headless was found to contain malicious code...
MAL-2025-22261 Malicious code in hathor-wallet-headless (npm)
The package hathor-wallet-headless was found to contain malicious code...
Linux Distros Unpatched Vulnerability : CVE-2024-40926
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/nouveau: don't attempt to schedule hpdwork on headless cards If the card doesn't have...
Linux Distros Unpatched Vulnerability : CVE-2023-6861
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - The nsWindow::PickerOpenvoid method was susceptible to a heap buffer overflow when running in headless mode. This vulnerability affects Firefox ESR 115.6,...
Linux Distros Unpatched Vulnerability : CVE-2023-52911
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: drm/msm: another fix for the headless Adreno GPU Fix another oops reproducible when rebootin...
Malicious Package
Overview headless-skia is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
Malicious code in headless-skia (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83bcceb835d149498bab1ac808c57632e42a51f4ee45c21cee8ab84b1ec14bb1 Any computer that has this package installed or running should be considered...
MAL-2025-6287 Malicious code in headless-skia (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83bcceb835d149498bab1ac808c57632e42a51f4ee45c21cee8ab84b1ec14bb1 Any computer that has this package installed or running should be considered...
CVE-2025-48883
Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS cross-site scripting vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding...
CVE-2025-48883 Chrome PHP is missing encoding in `CssSelector`
Chrome PHP allows users to start playing with chrome/chromium in headless mode from PHP. Prior to version 1.14.0, CSS Selector expressions are not properly encoded, which can lead to XSS cross-site scripting vulnerabilities. This is patched in v1.14.0. As a workaround, users can apply encoding...
CVE-2023-30843
Payload is a free and open source headless content management system. In versions prior to 1.7.0, if a user has access to documents that contain hidden fields or fields they do not have access to, the user could reverse-engineer those values via brute force. Version 1.7.0 contains a patch. As a...