McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting

McAfee Network Data Loss Prevention User-Agent 9.3.x contains a cross-site scripting vulnerability which allows remote attackers to get session/cookie information via modification of the HTTP request. id: CVE-2017-4011 info: name: McAfee Network Data Loss Prevention 9.3.x - Cross-Site Scripting...

ioc-finder

IOC Finder Извлечение индикаторов компрометации также известных как «observables» или «network data» — например, URL-адреса, адреса электронной почты и т. д. из текста. 📖 Документация она интерактивная! 💪 Я ищу спонсоров для этого проекта. У меня есть ряд улучшений и полезных функций, которые я...

CVE-2026-92542

A flaw was found in Moby. Firewall rules for encrypted Swarm overlay networks fail to distinguish between authentic kernel traffic and packets crafted by user processes. A local attacker can exploit this flaw by sending forged Virtual Extensible LAN VXLAN datagrams matching the overlay network...

CVE-2026-106455: Server-Side Request Forgery (SSRF)

Backstage is an open framework for building developer portals. From 0.11.12 until 1.14.7 and 1.15.5, the @backstage/plugin-techdocs-node package is affected by improper validation of mkdocs plugin configuration in techdocs. An authenticated attacker with control over a TechDocs source repository...

Astra Linux – Vulnerability in Chromium

Insufficient data validation in networking in Google Chrome prior to 87.0.4280.141 allowed a remote attacker to bypass discretionary access control via malicious network traffic...

Meari IoT Cloud Platform OpenAPI Service

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow attackers to manipulate device configurations, trigger unauthorized behaviors, and access sensitive information such as device credentials, owner details, and network data without proper authorization. 2. RECOMMENDED...

PT-2026-96141

Name of the Vulnerable Software and Affected Versions Hatchet versions prior to 0.91.1 Description The SNS UnsubscribeConfirmation handler in internal/integrations/ingestors/sns/sns.go performs an http.Get request on the UnsubscribeURL parameter within the payload. Because the BuildSignature...

CVE-2026-18653

The WP Directory Kit WordPress plugin before 1.5.7 does not sanitise and escape a parameter before using it in a SQL statement, allowing administrators to perform SQL injection attacks. On a multisite installation this lets an administrator of a single site read data belonging to the entire...

MAL-2026-12316 Malicious code in @cryptosrvc/shift-exchange-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ff6c468a083fe963c94caf5edbd3b36e83ba753c9c2d14c807f6a4bb3b6048a On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, SUDOUSER, home directory,...

Malicious code in @cryptosrvc/shift-exchange-root (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ff6c468a083fe963c94caf5edbd3b36e83ba753c9c2d14c807f6a4bb3b6048a On npm install, the package runs dist/recon.js as a postinstall script that collects the installer's hostname, username, SUDOUSER, home directory,...

MAL-2026-12317 Malicious code in @cryptosrvc/shift-sdk-v4 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bbcb95c5f9f9305e86cbeb749787dc845933c6273e91ab2d69138dee6fc2900a package.json declares a postinstall script node dist/recon.js || true that runs automatically on npm install. dist/recon.js collects installer host...

MAL-2026-12199 Malicious code in simple-date-formatter-new-8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4f0bf9e4040cf2940b0ca9a9e5cea7def2c660925afd0ba959ed69d28ca007b7 The package.json postinstall script runs unconditionally on npm install, collecting host and internal-network reconnaissance kernel version via uname...

Malicious code in simple-date-formatter-new-5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 204253c08cc90b592f9c086ada633879141aee2bdf27e7286007c709f3b866ab Package advertised as a date-formatting utility performs supply-chain attack behavior. package.json declares a postinstall shell one-liner that, on n...

PT-2026-66226

Side-channel information leakage in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Chromium security severity: Low...

CVE-2026-64742

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...

EUVD-2026-49469

This issue was addressed by using HTTPS when sending information over the network. This issue is fixed in iOS 26.6 and iPadOS 26.6, tvOS 26.6, visionOS 26.6, watchOS 26.6. An app may be able to access sensitive user data...

CVE-2026-65049 Ninja Forms Cross-Site Network-Wide Data Deletion on WordPress Multisite via nf_delete_all_data AJAX Action

Ninja Forms plugin version 3.14.8 and prior for WordPress Multisite contains an incorrect authorization vulnerability that allows a subsite Administrator to trigger network-wide deletion of all Ninja Forms data by exploiting a site-scoped capability check combined with unsafe multisite migration...

CVE-2026-64194

Net::DNS versions through 1.55 for Perl allow Denial of Service via deep DNS compression pointer chains. Net::DNS::DomainName::decode follows RFC 1035 compression pointers by recursing into itself with no depth limit. It is possible to construct a name which saturates the call stack at least with...

CVE-2026-35142

HCL DFXAnalytics is affected by an Internal IP Address Disclosure vulnerability. The application includes internal IP address details within its generated server responses, which could allow a remote attacker to gather sensitive network topology information and use it to map the internal...

MAL-2026-10678 Malicious code in ls-env-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db44619df34ccbffa5747f17c8135602583a781ec01f8d3c03e0f828157e944c Package declares a preinstall script node./index.js that fires automatically on npm install. The executed index.js issues an HTTP GET to a...