Malicious code in sm-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24 package.json declares preinstall and postinstall lifecycle scripts that each run curl -s http://16.192.173.5/sm-session/pre and curl -s...

Malicious code in sm-admin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa2741ebbd0df8c6f349a4d34361cc3d814fe878f3f4521fd771a855cfdc152b Package [email protected] defines preinstall and postinstall lifecycle scripts that issue plain-HTTP GET requests to a hardcoded bare-IP endpoint at...

GestioIP - Reflected Cross-Site Scripting

GestioIP v3.5.7 contains a reflected cross-site scripting caused by unsanitized input in the ipdojob request, letting attackers execute scripts in the victim's browser, exploit requires specific user permissions. id: CVE-2024-50857 info: name: GestioIP - Reflected Cross-Site Scripting author:...

Mailpit < 1.28.3 - Server-Side Request Forgery

Mailpit = 1.28.0 contains a server-side request forgery caused by insufficient validation of internal IP addresses in the /proxy endpoint, letting attackers make requests to internal network resources, exploit requires crafted HTTP GET requests. id: CVE-2026-21859 info: name: Mailpit 1.28.3 -...

Camtron CMNC-200 IP Camera - Directory Traversal

The CMNC-200 IP Camera has a built-in web server that is vulnerable to directory transversal attacks, allowing access to any file on the camera file system. id: CVE-2010-4231 info: name: Camtron CMNC-200 IP Camera - Directory Traversal author: daffainfo severity: high description: The CMNC-200 IP...

Fujitsu IP Series - Hardcoded Credentials

Fujitsu Real-time Video Transmission Gear “IP series” use hard-coded credentials, which may allow a remote unauthenticated attacker to initialize or reboot the products, and as a result, terminate the video transmission. The credentials cannot be changed by the end-user and provide administrative...

Joomla! Component OrgChart 1.0.0 - Local File Inclusion

A directory traversal vulnerability in the OrgChart comorgchart component 1.0.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the controller parameter to index.php. id: CVE-2010-1878 info: name: Joomla! Component OrgChart 1.0.0 - Local File Inclusion author:...

CVE-2026-74625

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

EUVD-2026-64411

In the Linux kernel, the following vulnerability has been resolved: ipvs: avoid out-of-bounds write in ipvsnaticmp Sashiko warns that local attacker can modify the packet while it is processed by IPVS. Some places read the IP ihl field multiple times which can cause out-of-bounds access. One such...

CVE-2026-74704 net/sched: sch_cake: drop WARN_ON(1) for malformed packets in ACK filter

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON1 which can...

EUVD-2026-64391

In the Linux kernel, the following vulnerability has been resolved: net/sched: schcake: drop WARNON1 for malformed packets in ACK filter The schcake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARNON1 which can...

CVE-2026-74625

CVE-2026-74625 is a memory leak in the Linux kernel 's netfilter bridge subsystem. When a bridge nftables ct zone set rule attaches a conntrack template to an skb, and the frame has a non-IPv4/non-IPv6 EtherType, nf_ct_bridge_pre() overwrites skb-&gt;_nfct with IP_CT_UNTRACKED without releasing t...

EUVD-2026-64562

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

CVE-2026-74625 netfilter: bridge: release template ct on non-IP path

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nfctbridgepre sees it. For non-IPv4 and non-IPv6 EtherTypes, nfctbridgepre currently...

CVE-2026-74588 sctp: keep chunk->transport in step with the list it is queued on

In the Linux kernel, the following vulnerability has been resolved: sctp: keep chunk-transport in step with the list it is queued on sctpoutqflushrtx moves a gap-acked chunk onto another transport's transmitted list without updating chunk-transport: if chunk-tsngapacked...

Western Digital MyCloud NAS - Authentication Bypass

It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. An unauthenticated attacker can exploit this vulnerability to authenticate as an admin user without needing to provide a password, thereby gaining full control of the...

CHIYU TCP/IP Converter - Carriage Return Line Feed Injection

CHIYU TCP/IP Converter BF-430, BF-431, and BF-450 are susceptible to carriage return line feed injection. The redirect= parameter, available on multiple CGI components, is not properly validated, thus enabling an attacker to obtain sensitive information, modify data, and/or execute unauthorized...

PT-2026-79630

In the Linux kernel, the following vulnerability has been resolved: netfilter: bridge: release template ct on non-IP path A bridge nftables ct zone set rule can attach a conntrack template to an skb before nf ct bridge pre sees it. For non-IPv4 and non-IPv6 EtherTypes, nf ct bridge pre currently...

PT-2026-79709

In the Linux kernel, the following vulnerability has been resolved: net/sched: sch cake: drop WARN ON1 for malformed packets in ACK filter The sch cake ACK filter parses packets to find the TCP header and filter duplicated ACKs if the flow is backlogged. The parsing code contains a WARN ON1 which...

CVE-2026-53791

A flaw in rsync allows an unauthenticated remote attacker to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source IP address, granting unauthorized access to restricted resources. Mitigation Restrict rsync daemon TCP/873 to the trusted proxy only CME-202...