mailorder

Mail Order The Nalpeiron Licensing Service NLSSRV32.exe is installed as part of certain software installations to handle privileged software licensing operations. It is paired with a client component filechck.dll which communicates with the service via mailslots hence the name. Calls are performe...

CitrixADC-CVE-2020-8300

Detect Citrix ADC SAML action or SAML iDP Profile config vulnerable to CVE-2020-8300 using Citrix ADC NITRO API EXAMPLE & '.\CitrixADC-CVE-2020-8300.ps1' -NSIPProtocol http -NSIP 10.10.10.10 -user nitro -pass "SshhhItsASecret" If this proves useful to anyone I will develop further with the...

citrix_adc_netscaler_lfi

citrixadcnetscalerlfiscan !alt textcitrix This Metasploit-Framework module can be use to help companies to check the last Citrix vulnerabilites disclosed July 08, 2020. CVE-2020-8193 CVE-2020-8195 CVE-2020-8196 Public reporting on July 8th, 2020 by Donny Maasland discussed how the vulnerability...

CVE-2025-55817

Vulnerability Type Cross Site Scripting XSS Affected Component The Connection Settings of the Nitro GraphQL by Chillicream, contain 3 different input locations vulnerable to Cross Site Scripting XSS. Vulnerable Parameters : SDL Schema Endpoint, Subscription Endpoint, SSE Subscription Endpoint...

Medium: docker

Issue Overview: Due to security concerns regarding a small set of intermediate certificates issued by a specific Certificate Authority CA, the Go's crypto/x509 package is updated to not trust certificates issued by the affected intermediate certificates. This would prevent possible future misuse ...

CVE-2025-45528

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF...

CVE-2026-98775

A flaw was found in the Linux kernel's Nitro Enclaves driver. An error-handling defect during enclave creation allows memory to be accessed after it has already been freed. A local attacker could exploit this use-after-free condition to cause a system crash, resulting in a Denial of Service DoS, ...

EUVD-2025-211197

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF...

CVE-2025-45528

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to achieve arbitrary code execution by processing a crafted PDF file. No specific root cause, remediation details, or exploit links are provided in the documents beyond the sighting of a proof-of-concept. Explo...

CVE-2025-45528

An issue in Nitro Software, Inc Nitro PDF Pro for macOS v.14.7 allows a local attacker to execute arbitrary code via a crafted PDF...

EUVD-2026-107416

Nuxt: Server-side route rules redirect, headers, proxy, ssr are skipped for case-variant paths when routing is case-insensitive...

Incorrect Authorization

Overview @nuxt/nitro-server is a Nitro server integration for Nuxt Affected versions of this package are vulnerable to Incorrect Authorization via case-sensitive matching of server-side route rules, where route rule protections such as redirect, headers, and proxy rules can be bypassed by an...

CVE-2026-114132

Nuxt is an open-source web development framework for Vue.js. Prior to 4.6.2, Nuxt resolves pages case-insensitively by default while Nitro matches server-side route-rule keys case-sensitively, allowing a request whose path differs only by letter case to render without the server rule intended for...

PT-2026-120735

Name of the Vulnerable Software and Affected Versions Nuxt versions prior to 4.6.2 Description Nuxt resolves pages case-insensitively by default, whereas Nitro matches server-side route-rule keys case-sensitively. This discrepancy allows requests with paths that differ only by letter case to rend...

PT-2026-116994

In the Linux kernel, the following vulnerability has been resolved: nitro enclaves: fix use-after-free on SLOT ALLOC failure When ne create vm ioctl fails the SLOT ALLOC request after anon inode getfile has succeeded, the error path calls fputenclave file and then frees ne enclave. In normal...

Malicious code in nitro-bundled-dep (npm)

Source: amazon-inspector 0bbd4417bf91aba92399be259604511102ec5dfbacebe278a7922cf10c4deac5 [email protected] ships a stub main module a Proxy that no-ops any property access plus beacon.cjs, which runs both from the postinstall lifecycle hook node beacon.cjs and on top-level require of...

Malicious code in nitro-cjs-requirer (npm)

Source: amazon-inspector b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostname, dirname install path, process.cwd, and node version to...

MAL-2026-17775 Malicious code in nitro-cjs-requirer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b78ca7e6d900dde3d7b9a367cdc359f3ec47a8b662ff53dd9c6542edbdb00b0b The package is a beacon carrier with no real functionality. The declared postinstall script runs beacon.cjs, which POSTs the package name, os.hostnam...

MAL-2026-17774 Malicious code in nitro-bundled-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622 The npm package [email protected] presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname,...

Malicious code in nitro-bundled-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 893585fb7fdf6e13f0b443e3bd8bd84e8ba1a7c88400ecf5aa9a144a06acd622 The npm package [email protected] presents itself as a 'Compatibility shim' but ships a beacon that POSTs installer host metadata — hostname,...