GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, linkerd2-proxy-init, shfmt, mongodb-kubernetes-operator, nats, grafana-operator, hivemind, git-lfs, cloud-provider-aws, confluent-common-docker, docker-credential-ecr-login, sftpgo-plugin-pubsub, dagdotdev, bank-vaults, vault-k8s, gitsign,...

CVE-2025-47906 vulnerabilities

Vulnerabilities for packages: eks-distro-fips, nemo, rancher-machine, consul-fips, mattmoor-chainit, yace-fips, php-fpmexporter, etcd-fips, prometheus-beat-exporter-fips, kubernetes-dashboard-fips, sftpgo-plugin-geoipfilter, kubeflow-katib, karma-fips, terraform-provider-sendgrid-fips,...

GHSA-GWRF-JF3H-W649 vulnerabilities

Vulnerabilities for packages: eks-distro-fips, nemo, rancher-machine, consul-fips, mattmoor-chainit, yace-fips, php-fpmexporter, etcd-fips, prometheus-beat-exporter-fips, kubernetes-dashboard-fips, sftpgo-plugin-geoipfilter, kubeflow-katib, karma-fips, terraform-provider-sendgrid-fips,...

DEBIAN-CVE-2022-50309

In the Linux kernel, the following vulnerability has been resolved: media: xilinx: vipp: Fix refcount leak in xvipgraphdmainit ofgetchildbyname returns a node pointer with refcount incremented, we should use ofnodeput on it when not need anymore. Add missing ofnodeput to avoid refcount leak...

MAL-2025-41491 Malicious code in @twork-data-services/customer-api-v2-customer-vip-status (npm)

--- -= Per source details. Do not edit below this line.=-...

Important: ppp

Issue Overview: The passprompt plugin in pppd in ppp before 2.5.2 mishandles privileges. CVE-2024-58250 Affected Packages: ppp Note: This advisory is applicable to Amazon Linux 2 AL2 Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories. Issue...

CVE-2024-12896

A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222 and classified as problematic. Affected by this issue is some unknown functionality of the file /webcaps/webCapsConfig of the component Web Interface. The manipulation leads to...

CVE-2024-12897

A vulnerability was found in Intelbras VIP S3020 G2, VIP S4020 G2, VIP S4020 G3 and VIP S4320 G2 up to 20241222. It has been classified as critical. This affects an unknown part of the file ../mtd/Config/Sha1Account1 of the component Web Interface. The manipulation leads to path traversal:...

CVE-2023-3015

A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The...

CVE-2023-3016

A vulnerability was found in yiwent Vip Video Analysis 1.0 and classified as problematic. Affected by this issue is some unknown functionality of the file admin/admincore.php. The manipulation leads to cross site scripting. The attack may be launched remotely. The exploit has been disclosed to th...

CVE-2022-31572

The ceee-vip/cockybook repository through 2015-04-16 on GitHub allows absolute path traversal because the Flask sendfile function is used unsafely...

CVE-2020-15468

Persian VIP Download Script 1.0 allows SQL Injection via the cartedit.php active parameter...

CVE-2019-12754

Symantec My VIP portal, previous version which has already been auto updated, was susceptible to a cross-site scripting XSS exploit, which is a type of issue that can enable attackers to inject client-side scripts into web pages viewed by other users or potentially bypass access controls such as...

CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4

CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4. A patched version of the package is available...

AZL-60573 CVE-2025-22872 affecting package kube-vip-cloud-provider for versions less than 0.0.10-4

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

“Follow me” to this fake crypto exchange to claim $500

A type of crypto scam that we reported about in 2024 has ported over to a new platform and changed tactics—a bit. Where the old scams mostly reached me on WhatsApp, the same group of scammers is now using Direct Messages on X. However, the same old trick of "accidentally" sending you login detail...

CVE-2024-51744 affecting package kube-vip-cloud-provider for versions less than 0.0.2-22

CVE-2024-51744 affecting package kube-vip-cloud-provider for versions less than 0.0.2-22. A patched version of the package is available...

AZL-77517 CVE-2025-30204 affecting package kube-vip-cloud-provider for versions less than 0.0.2-26

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20

CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20. A patched version of the package is available...

AZL-57108 CVE-2025-27144 affecting package kube-vip-cloud-provider for versions less than 0.0.2-20

Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption JWE, JSON Web Signature JWS, and JSON Web Token JWT standards. In versions on the 4.x branch prior to version 4.0.5, when parsing compact JWS or JWE...