11 matches found
GHSA-W7W5-5GCP-38RW nebula-mesh: Web UI and API responses lack security headers (CSP, X-Frame-Options, HSTS, etc.)
None of the response paths in internal/web/ or internal/api/ set the standard browser-security headers. grep for Content-Security-Policy, X-Frame-Options, Strict-Transport-Security, X-Content-Type-Options, Referrer-Policy returns zero matches across the codebase. Impact The admin UI signs CA...
Malicious code in adform-ui-api (npm)
The package adform-ui-api was found to contain malicious code...
MAL-2025-14092 Malicious code in adform-ui-api (npm)
The package adform-ui-api was found to contain malicious code...
MAL-2024-8018 Malicious code in cargo-hub-ui-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3a93015c0c7cee38c5cd1b53a2705bbfcddacfc8efc4f2fb930268b28d34e190 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in cargo-hub-ui-api-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8165fa0cd101e6b1ef78a13e6355f2f54b163dad9b094756aeb50ad2ce54b516 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-8019 Malicious code in cargo-hub-ui-api-internal (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8165fa0cd101e6b1ef78a13e6355f2f54b163dad9b094756aeb50ad2ce54b516 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-20851
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input...
CVE-2022-20851 Cisco IOS XE Software Web UI Command Injection Vulnerability
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input...
CVE-2022-20851
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this vulnerability by sending crafted input...
