Malicious code in vhx-node-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97a8bc9059906dee3aacb8bfb00ab219e1fb0cc948a15b861d2455a4a36ec006 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-1239 Malicious code in vhx-node-demo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97a8bc9059906dee3aacb8bfb00ab219e1fb0cc948a15b861d2455a4a36ec006 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4554 Malicious code in meoconlonton-vhx-fresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc7692a67d16307a44291bbb7204f96bc2670e25955f8802c420a30095e5df42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in meoconlonton-vhx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e40d361e3fbc30040dc775b7b51fa26ae2f9a5034066803de753a73ec3132c30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in meoconlonton-vhx-fresh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc7692a67d16307a44291bbb7204f96bc2670e25955f8802c420a30095e5df42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4553 Malicious code in meoconlonton-vhx-cricle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74e46219c746f5ca66a9837373c50e7039b60c93dc0b1a32e9de119138af4dd8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Vimeo: Possibility to overwrite any file in the vpe.cdn.vimeo.tv leads to the Stored XSS for the all customers on the embed.vhx.tv

By modifying the Content-Type to be blank, during a PUT command, the researcher was able to upload files to the CDN. This has been resolved. It was possible to write and overwrite arbitrary files to the CDN vpe.cdn.vimeo.tv used for JS scripts delivery on the various in-scope assets using the PUT...