4286 matches found
CVE-2026-70437
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...
CVE-2026-70437
Summary (concrete): Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfa_f0215cf5 and earlier does not use a constant-time comparison when checking the webhook bearer token, potentially enabling attackers to apply statistical methods to obtain a valid token. This is a network-facing issue ...
CVE-2026-70437
Jenkins Webhook Secret Credentials Provider Plugin 16.v0cfaf0215cf5 and earlier does not use a constant-time comparison function when checking whether the provided and expected webhook bearer token are equal, potentially allowing attackers to use statistical methods to obtain a valid webhook bear...
MAL-2026-13352 Malicious code in stellar-api-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd4c86bebaa61a9aada2c1686d68eb5119025ea4646426ea7da3db4ce4208707 The package's constructor unconditionally appends a hardcoded Discord user ID 1489655840662093854 to the caller-supplied adminIds list, granting that...
CVE-2026-71271
Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does. Becau...
CVE-2026-71272
Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...
MAL-2026-12797 Malicious code in multi-reqs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...
Malicious code in multi-reqs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38937963f906d0bf3b4dac24a1a45f574aeb53cd2f268ffb9730d88bedf50bce The package's default export accepts token, password arguments and POSTs them, formatted as a Discord embed titled 'Yeni Hesap Bilgisi' with fields '...
Malicious code in voicemail (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 568a31285f414d8125b5749bc8e070157ffd403ce46e46da637cc1452f99d19f package.json declares both preinstall and postinstall lifecycle scripts that invoke curl against a hardcoded webhook.site endpoint...
Malicious code in clover-codelab-remote-pay-cloud (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 071fbdd6b5ca7cbb0fc696f5abf7a47be3783dd970ca5594cb415e67579f2b15 The package declares a postinstall hook that runs index.js on npm install. index.js collects the OS username, current working directory, hostname, an...
Malicious code in pp-react-worldready-v5 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 435cbd5d4dffc9d7e61222051c82a376bf6dd5a484760803953484ea0fa21b39 The tarball contains only package.json and vishu.js; the declared main index.js is absent, so the package has no library functionality...
Malicious code in wagmi-react (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6285993305d8ff9bbf69804dcbf929539b6f48c2ef1b1ca6e5c723150c5565ee The package impersonates the wagmi/viem wallet API surface exporting createWalletClient, parseAccount, and a WalletClient constructor and, when a...
Malicious code in @offa/offa-uwk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a04489d4763fb48f4c5bc4ea7e99802b21a412ba55900ae7bf411070e2a42d8 package.json declares a postinstall hook that runs index.js. On install, index.js collects os.hostname, os.userInfo.username, process.cwd, and the...
Malicious code in @offa-uwk/offa-uwk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 115f62b574a9c9c91a35c6a489b74a38d6132b4d8e706deb388d2f6df1dc32f2 On npm install, the package's postinstall script node index.js collects host identifiers os.hostname, os.userInfo.username, process.cwd and POSTs the...
Malicious code in uniswap-sdk-v4 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a9d01efda86c7ce792f8396d425dce51600262660989f438dd13a17068d9df6d The package presents itself as a Uniswap V4 SDK but its WalletClient constructor captures the caller-supplied private key and POSTs it, along with th...
CVE-2026-71272 Memos Webhook DNS Rebinding TOCTOU SSRF in safeDialContext()
Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...
CVE-2026-71272
CVE-2026-71272 affects Memos’ webhook dispatch function safeDialContext() in internal/webhook/webhook.go. The code resolves the target hostname with net.DefaultResolver.LookupHost(), validates the resulting IPs against reserved ranges, but then dials net.JoinHostPort(host, port) using the origina...
EUVD-2026-53357
Memos' webhook dispatch function safeDialContext internal/webhook/webhook.go resolves the target hostname via net.DefaultResolver.LookupHost and validates the resulting IPs against reserved ranges, but then dials net.JoinHostPorthost, port using the original hostname rather than the...
CVE-2026-71271 Memos Webhook SSRF via 0.0.0.0 Reserved-IP Bypass
Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does. Becau...
EUVD-2026-53356
Memos' webhook URL validation, isReservedIP internal/webhook/validate.go, checks a candidate IP against a reservedCIDRs list that omits 0.0.0.0/8 and never calls ip.IsUnspecified — unlike the correctly implemented sibling function isInternalIP in internal/httpgetter/htmlmeta.go, which does. Becau...