PT-2024-38520 · Foreman · Foreman

Name of the Vulnerable Software and Affected Versions: Foreman affected versions not specified Description: A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker...

Foreman 命令注入漏洞

Foreman is Foreman's open source set of lifecycle management tools for use in physical and virtual servers. The tool provides service provisioning, configuration management, and status reporting. A command injection vulnerability exists in Foreman, which was discovered via the "Install Packages"...

MAL-2024-12198 Malicious code in artifact-lab-3-package-34b21b63 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 a814378a8188b464c5289007203c2b20c3ec2a0383ee18bd96e0f41ad44d7982 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

MAL-2024-12195 Malicious code in artifact-lab-3-package-1f7a39bc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 986e5ddc5b52149bd60f2e303abd548699bee247784d2201ea6e6814790557bf Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

Malicious code in artifact-lab-3-package (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 0c18a16c7c21d93a8819aed298f6691835b1a31546ca573eb94ce4265d4fb291 Packages showing simple variants of revshell with targets to ngrok. Most probably experiments. Later versions moved to use Burp Collaborator to exfiltrate simp...

CISA Warns of Hackers Exploiting Legacy Cisco Smart Install Feature

The U.S. Cybersecurity and Infrastructure Security Agency CISA has disclosed that threat actors are abusing the legacy Cisco Smart Install SMI feature with the aim of accessing sensitive data. The agency said it has seen adversaries "acquire system configuration files by leveraging available...

Best Practices for Cisco Device Configuration

In recent incidents, CISA has seen malicious cyber actors acquire system configuration files by leveraging available protocols or software on devices, such as abusing the legacy Cisco Smart Install feature. CISA recommends organizations disable Smart Install and review NSA’s Smart Install Protoco...

Fedora: Security Advisory (FEDORA-2024-81c4b76a71)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora: Security Advisory (FEDORA-2024-c7bb042d5b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Apple Security Update: macOS Sonoma 14.6.1

Apple recommends to install security update macOS Sonoma 14.6.1 on devices macOS Sonoma...

Apple Security Update: macOS Ventura 13.6.9

Apple recommends to install security update macOS Ventura 13.6.9 on devices macOS Ventura...

Fedora: Security Advisory (FEDORA-2024-61c5b8951b)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

KLA71412 OSI vulnerability in Microsoft Office

Information disclosure vulnerability was found in Microsoft Office. Malicious users can exploit this vulnerability to obtain sensitive information. Original advisories CVE-2024-38206 CVE list CVE-2024-38206 critical Solution Install necessary updates from the KB section, that are listed in your...

Malicious code in advdef01 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 44ffce32113cbe3c908fd584f4b02617cafcfecccc3cea1c4fc068021c4bfa7d Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

Malicious code in paquete-5 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4f3a3134bb30ff4d1c08b8ab3469f769ad1a1654d39e0c3e818973063d524d75 Package uses the template from https://github.com/thegoodhackertv/malpip to explore building malicious PyPI packages. --- Category: MALICIOUS - The campaign ha...

Malicious code in lambda-sns-dynatrace-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6846e2cf86562a1515400ba129d4fef5beb818c3002079e8bdd09c9e86f00fc5 Any computer that has this package install...

Malicious code in pydevd-inject (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a67732a19f213875b774ca8fb24e8d3c1c3cd9d357cf7e6425a3ee3eadb9f3a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in crunchie (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 f26d858f791d6d12aab4d70b3f5494c2b675934ba0b13cffa405ecd0686cfa91 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in this-is-poc-fortesting-dontinstall-12345 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6731f0b45ddfd51d7b4ede3181c38007a58a01e569b13d867b987cd9487ee472 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in szn-zbozi-ab-testing-fulltext (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 7df3ea38b323257215fac35c84d508a123246b91b32f77e46c1e9f0c03a74503 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...