643 matches found
Magento's X-Original-Url header can expose admin url
Impact The admin url can be discovered without prior knowledge of it's location by exploiting the X-Original-Url header on some configurations. Patches The bug comes from the Zend library and is patche by unsetting the header in the bootstrap process. Workarounds Unset the X-Original-Url header i...
PT-2026-6440
Impact The admin url can be discovered without prior knowledge of its location by exploiting the X-Original-Url header on some configurations. Patches The bug comes from the Zend library. Workarounds Unset the X-Original-Url header in the web server configuration. Resources...
PT-2026-6312
Name of the Vulnerable Software and Affected Versions Magento-lts versions prior to 20.16.1 Description Magento-lts is a long-term support alternative to Magento Community Edition CE. Prior to version 20.16.1, the admin URL can be discovered without prior knowledge of its location by exploiting t...
thoropass-vuln-research-program
Thoropass Vulnerability Research Program 🔐 Security Researc...
Rectifying Adversarial Examples Using Their Vulnerabilities
Deep neural network-based classifiers are prone to errors when processing adversarial examples AEs. AEs are minimally perturbed input data undetectable to humans posing significant risks to security-dependent applications. Hence, extensive research has been undertaken to develop defense mechanism...
Critical: Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.25.0 Release.
Red Hat OpenShift Dev Spaces 3.25.0 has been released. Red Hat OpenShift Dev Spaces provides a cloud developer workspace server and a browser-based IDE built for teams and organizations. Dev Spaces runs in OpenShift and is well-suited for container-based development. The 3.25 release is based on...
Improper Access Control
github.com/mattermost/mattermost-server is vulnerable to improper access control. The vulnerability is due to Mattermost failing to verify whether a user has permission to join a team when using the original invite token, which allows an attacker to manipulate the OAuth state and join any team on...
EUVD-2025-117186
Malicious code in original-lavender-hoverfly npm...
MAL-2025-138916 Malicious code in original-lavender-hoverfly (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1a7cff724291031461ab159ba45bb2ac32653ad7f88919277281836ad9fda92a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
Malicious code in original_rodent_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d9f10e752a19d410e00c7a740851009dc73086c1e0113f27961f9dc844068515 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-103125
Malicious code in originalcarpz3n npm...
Malicious code in original_wren_z3n (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f0b5254c9be5714779cd032d360ee9e680ecbc8f4760d33dce6c7d91b80397d9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-95881
Malicious code in originallemurz3n npm...
EUVD-2025-95882
Malicious code in originalantelopez3n npm...
EUVD-2025-89563
Malicious code in originalmarmotz3n npm...
EUVD-2025-89564
Malicious code in originalbeetlez3n npm...
EUVD-2025-74396
Malicious code in originalamphibianmoccasin-61 npm...
EUVD-2025-74395
Malicious code in originalorcasilver-60 npm...