13587 matches found
Malicious code in devplatform-spa-errors (npm)
Source: amazon-inspector 5cb27f42d7166d8e64db0a98a48a18f64817d801d1e4b6250c62320f08143d59 On require of the package, index.js unconditionally loads loader.js, which selects a platform-specific payload path, fetches an opaque native binary from string-concatenated Cloudflare Workers subdomains...
CVE-2026-54201
The CVE-2026-54201 entry concerns Tobit Laboratories AG TeamDavid’s Webbox. The issue: missing authentication/authorization when serving log files, enabling attackers to obtain sensitive error information or internal application details. Affected component: TeamDavid through Rollout 524. The vuln...
[SECURITY] Fedora 43 Update: abrt-2.17.9-1.fc43
abrt is a tool to help users to detect defects in applications and to create a bug report with all information needed by maintainer to fix it. It uses plugin system to extend its functionality...
CVE-2026-71445 Authenticated Reflected Cross-Site Scripting in Tag Error Responses in ail-framework
AIL Framework contained a reflected cross-site scripting vulnerability in the /tag/addtags endpoint. When an error occurred while processing a tag operation, the application returned the error value directly as an HTML response using strres0. If attacker-controlled input was included in the...
ANGLE Component Confidential Data Access
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
ANGLE Component Confidential Data Access
The vulnerability of the ANGLE web browser component in Google Chrome is related to errors during variable initialization. Exploiting this vulnerability can allow an attacker to gain access to confidential data through a specially created HTML page...
PDFium DoS
The vulnerability of the PDFium component in Google Chrome and Microsoft Edge browsers is related to errors in HTTP requests processing. Exploiting this vulnerability can allow an attacker to cause service interruptions using a specially created font file...
Linux kernel MMC/SD/SDIOS DoS
The vulnerability in the dwcmshcrk3568setclock function within the drivers/mmc/host/sdhci-of-dwcmshc.c file of the Linux kernel-based MMC/SD/SDIOS driver is related to state management errors. Exploitation of this vulnerability may allow an attacker to cause a denial of service...
ANGLE DoS
The vulnerability of the ANGLE component in Google Chrome and Microsoft Edge is related to errors during initialization of variables. Exploiting this vulnerability can allow an attacker to cause a service failure through a specially created HTML page...
Skia Graphic Library DoS
The vulnerability of the Skia graphic library in Google Chrome and Microsoft Edge is related to data type conversion errors. Exploiting this vulnerability could allow an attacker to cause a service failure through a specially created HTML page...
Views Component Spear Phishing
The vulnerability of the Views component in Google Chrome and Microsoft Edge is related to information representation errors in the user interface. Exploiting this vulnerability can allow an attacker to perform spear-phishing attacks remotely...
ROS-20260806-73-0035
The vulnerability of the bamdmaprobe function in the drivers/dma/qcom/bamdma.c file of the Linux kernel’s DMA driver module is related to state management errors. Exploiting this vulnerability could allow an attacker to cause a system failure...
Linux kernel uacce_put_queue uacce_fops_unl_ioctl Data Compromise
The vulnerabilities of the functions uacceputqueue and uaccefopsunlioctl in the drivers/misc/uacce/uacce.c module of the Linux kernel are related to state management errors. Exploiting these vulnerabilities can allow attackers to compromise the confidentiality, integrity, and accessibility of...
WP < 7.0.3 - Reflected XSS
Description WordPress does not escape login error message in some cases, which could lead to Reflected XSS...
GHSA-GWFQ-86J8-7QHV rclone: Verbose Stack Trace Disclosure in RC API Error Responses
Summary When an RC API call triggers a panic recovered by the job runner, the full Go stack trace is included in the JSON error response. This leaks internal file paths, Go module versions, goroutine state, and memory addresses to the API caller. Details The panic recovery in...
MAL-2026-12317 Malicious code in @cryptosrvc/shift-sdk-v4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a package.json declares a postinstall script node dist/recon.js || true that runs automatically on npm install. dist/recon.js collects installer host...
MAL-2026-12406 Malicious code in pfa-errors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...
Malicious code in pfa-errors (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9e06752c5f827cccdf98f23fa26d893d44e2889b8b7011e8fdb130524f09fe0f On require'pfa-errors', index.js unconditionally loads runtime.js, which fetches a platform-specific opaque binary from one of three hardcoded...
