10121 matches found
Human vs. Non-Human Identity in SaaS
In today's rapidly evolving SaaS environment, the focus is on human users. This is one of the most compromised areas in SaaS security management and requires strict governance of user roles and permissions, monitoring of privileged users, their level of activity dormant, active, hyperactive, thei...
MAL-2024-1057 Malicious code in pcln-event-dispatcher (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 58d0757d5f390b101d520dbcfa438dc8fdf9197eccea3aae851f57a1cb09eeb3 The OpenSSF Package Analysis project identified 'pcln-event-dispatcher' @ 999999999.99.9 npm as malicious. It is considered malicious because: -...
CVE-2023-49988
creationtimestamp| type| source ---|---|--- 2024-03-07 02:26:54+00:00| seen| https://t.me/ctinow/201994 2024-03-07 02:27:11+00:00| seen| https://t.me/ctinow/202006...
CVE-2024-28111 CSV Injection in exported history CSV files
Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-base...
CVE-2024-20338
creationtimestamp| type| source ---|---|--- 2024-03-06 18:26:42+00:00| seen| https://t.me/ctinow/201617 2024-03-08 01:22:05+00:00| seen| https://t.me/arpsyndicate/4135...
CVE-2023-42776
creationtimestamp| type| source ---|---|--- 2024-03-06 14:41:31+00:00| seen| https://t.me/ctinow/201402...
MAL-2024-1055 Malicious code in add-sugar (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8c35253404a0c432c7a012459997f522c42254fc055677eab50061c9f4b39edc The OpenSSF Package Analysis project identified 'add-sugar' @ 1.0.10 npm as malicious. It is considered malicious because: - The package...
BIT-GITLAB-2020-13315
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service...
BIT-GITLAB-2020-13324
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API...
BIT-DISCOURSE-2022-24782 Secure category names leaked via user activity export in Discourse
Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to catego...
BIT-MOODLE-2022-0332
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data...
BIT-REDMINE-2021-42326
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter...
BIT-MOODLE-2023-5539 Moodle: authenticated remote code execution risk in lesson
A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers...
BIT-MOODLE-2023-5540 Moodle: authenticated remote code execution risk in imscp
A remote code execution risk was identified in the IMSCP activity. By default this was only available to teachers and managers...
BIT-MOODLE-2023-5543 Moodle: duplicating a bigbluebutton activity assigns the same meeting id
When duplicating a BigBlueButton activity, the original meeting ID was also duplicated instead of using a new ID for the new activity. This could provide unintended access to the original meeting...
CVE-2024-1356
creationtimestamp| type| source ---|---|--- 2024-03-05 22:26:17+00:00| seen| https://t.me/ctinow/200753 2024-03-05 22:32:08+00:00| seen| https://t.me/ctinow/200763...
American Express warns customers about third party data breach
American Express has sent affected customers a warning that “a third party service provider engaged by numerous merchants experienced unauthorized access to its system.” In a subsequent update, American Express explained that it was not a service provider, but a merchant processor that suffered t...
CVE-2024-26334
creationtimestamp| type| source ---|---|--- 2024-03-05 10:27:26+00:00| seen| https://t.me/ctinow/200074 2024-03-05 10:27:30+00:00| seen| https://t.me/ctinow/200078...