9190 matches found
PT-2025-35322
Name of the Vulnerable Software and Affected Versions Next.js versions prior to 14.2.32 and prior to 15.4.7 Description Next.js is a React framework for building full-stack web applications. When the next function was used without explicitly passing the request object in self-hosted applications,...
Use of a Key Past its Expiration Date
Overview Affected versions of this package are vulnerable to Use of a Key Past its Expiration Date due to improper enforcement of OIDC token expiry in the authentication process when no refresh token is provided. An attacker can maintain unauthorized access to the service by continuously using a...
Access Control Bypass
Overview @koa/router is a Affected versions of this package are vulnerable to Access Control Bypass. due to the middleware being silently dropped from the execution chain when the router prefix contains path parameters. Depending on what the skipped middleware was supposed to protect, an attacker...
Exploit for CVE-2025-29927
CVE-2025-29927 - Next.js Middleware 15.2.2 - Authorization Byp...
Security Bulletin: IBM watsonx Orchestrate Cartridge affected by vulnerability in http-proxy-middleware-2.0.7.tgz
Summary IBM watsonx Orchestrate Cartridge contains a vulnerable version of http-proxy-middleware-2.0.7.tgz Vulnerability Details CVEID:CVE-2025-32997 DESCRIPTION: In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. CWE:CWE-754: Improp...
Linux Distros Unpatched Vulnerability : CVE-2021-40797
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in the routes middleware in OpenStack Neutron before 16.4.1, 17.x before 17.2.1, and 18.x before 18.1.1. By making API requests involvin...
Linux Distros Unpatched Vulnerability : CVE-2020-35239
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability exists in CakePHP versions 4.0.x through 4.1.3. The CsrfProtectionMiddleware component allows method override parameters to bypass CSRF checks b...
Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in http-proxy-middleware-2.0.7.tgz
Summary IBM Watson Discovery Cartridge contains a vulnerable version of http-proxy-middleware-2.0.7.tgz Vulnerability Details CVEID:CVE-2025-32997 DESCRIPTION: In http-proxy-middleware before 2.0.9 and 3.x before 3.0.5, fixRequestBody proceeds even if bodyParser has failed. CWE:CWE-754: Improper...
Linux Distros Unpatched Vulnerability : CVE-2021-22942
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A possible open redirect vulnerability in the Host Authorization middleware in Action Pack = 6.0.0 that could allow attackers to redirect users to a malicious...
Remote Code Execution (RCE)
github.com/tnborg/panel is vulnerable to Remote Code Execution RCE. The vulnerability is due to improper path handling in the CleanPath middleware from the go-chi/chi package, which fails to process r.URL.Path, followed by flaws in backend login path exposure, which allows an attacker to bypass...
Linux Distros Unpatched Vulnerability : CVE-2016-5537
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Unspecified vulnerability in the NetBeans component in Oracle Fusion Middleware 8.1 allows local users to affect confidentiality, integrity, and availability vi...
Linux Distros Unpatched Vulnerability : CVE-2013-7370
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - node-connect before 2.8.1 has XSS in the Sencha Labs Connect middleware CVE-2013-7370 Note that Nessus relies on the presence of the package as reported by the...
Linux Distros Unpatched Vulnerability : CVE-2022-29248
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Guzzle is a PHP HTTP client. Guzzle prior to versions 6.5.6 and 7.4.3 contains a vulnerability with the cookie middleware. The vulnerability is that it is not...
Malicious code in middleware-nestjs-postcss-leda (npm)
The package middleware-nestjs-postcss-leda was found to contain malicious code...
Malicious code in tag-middleware (npm)
The package tag-middleware was found to contain malicious code...
Malicious code in blog-post-prisma-middleware-cls-hooked (npm)
The package blog-post-prisma-middleware-cls-hooked was found to contain malicious code...
Malicious code in halley-middleware-blazar-brane (npm)
The package halley-middleware-blazar-brane was found to contain malicious code...
Malicious code in arthur-middleware (npm)
The package arthur-middleware was found to contain malicious code...