CVE-2023-5804

creationtimestamp| type| source ---|---|--- 2023-10-27 00:18:07+00:00| seen| https://t.me/cibsecurity/73008...

PT-2023-13423 · Vermeg · Vermeg Agilereporter

Name of the Vulnerable Software and Affected Versions: VERMEG AgileReporter version 21.3 Description: An issue was discovered in VERMEG AgileReporter where attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log. Recommendations: For VERMEG AgileReporter...

PT-2023-27274 · Google · Android

Name of the Vulnerable Software and Affected Versions: PipTaskOrganizer.java affected versions not specified Description: The issue is related to a logic error in the code of PipTaskOrganizer.java, specifically in the onTaskAppeared method. This error can be exploited to bypass background activit...

VERMEG Agile Reporter Security Breach

VERMEG Agile Reporter is a hybrid of pre-packaged modules from VERMEG. A security vulnerability exists in VERMEG Agile Reporter version 21.3 that originates from an attacker being able to gain privileges by injecting cross-site scripting XSS into an Add Comment operation in the Activity log...

CVE-2022-34834

An issue was discovered in VERMEG AgileReporter 21.3. Attackers can gain privileges via an XSS payload in an Add Comment action to the Activity log...

How to catch a wild triangle

In the beginning of 2023, thanks to our Kaspersky Unified Monitoring and Analysis Platform KUMA SIEM system, we noticed suspicious network activity that turned out to be an ongoing attack targeting the iPhones and iPads of our colleagues. The moment we understood that there was a clear pattern in...

Kazakhstan-associated YoroTrooper disguises origin of attacks as Azerbaijan

Cisco Talos assesses with high confidence that YoroTrooper, an espionage-focused threat actor first active in June 2022, likely consists of individuals from Kazakhstan based on their use of Kazakh currency and fluency in Kazakh and Russian. The actor also appears to have a defensive interest in t...

Cross-site Scripting (XSS)

nagvis is vulnerable to Cross-site Scripting XSS. An attacker could exploit this vulnerability by tricking a user into clicking on a malicious link or visiting a malicious website. The malicious link or website would contain a specially crafted XSS payload, which would be injected into the NagVis...

MAL-2023-8396 Malicious code in fec-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis dcb9ae48dadfaae28ed7f4c8edcde694f63b90d1e7533c789704cabc4147c8c7 The OpenSSF Package Analysis project identified 'fec-sdk' @ 0.2.9 npm as malicious. It is considered malicious because: - The package communicat...

1Password Detects Suspicious Activity Following Okta Support Breach

Popular password management solution 1Password said it detected suspicious activity on its Okta instance on September 29 following the support system breach, but reiterated that no user data was accessed. "We immediately terminated the activity, investigated, and found no compromise of user data ...

Malicious code in fbdebug (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2edf3045263e059e2b1599655b25cc167abecc4d1e77e5e7e8d62998b0fd9e18 The OpenSSF Package Analysis project identified 'fbdebug' @ 0.1 pypi as malicious. It is considered malicious because: - The package communicate...

MAL-2023-8395 Malicious code in billing.api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 507cfdb034cfdde119a280e16b6ad66952ff26fd821fd25ec866bf04f29398f1 The OpenSSF Package Analysis project identified 'billing.api' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in npm-research-enum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 32f39024ba535c374e98c41355c2663f4ae5a92ff25df3c0f8cc60837ec06d56 The OpenSSF Package Analysis project identified 'npm-research-enum' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8394 Malicious code in npm-research-enum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 32f39024ba535c374e98c41355c2663f4ae5a92ff25df3c0f8cc60837ec06d56 The OpenSSF Package Analysis project identified 'npm-research-enum' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Moodle < 3.9.24, 3.11.x < 3.11.17, 4.0.x < 4.0.11, 4.1.x < 4.1.6, 4.2.x < 4.2.3 Multiple Vulnerabilities

Moodle is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:moodle:moodle"; ifdescription...

MAL-2023-8391 Malicious code in @banana-cake-pop/data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 62a20ff9ddb55a8de5c7bffe9455b25f0fca2223207e80cf7b9d7993bd02db12 The OpenSSF Package Analysis project identified '@banana-cake-pop/data' @ 1.9.10 npm as malicious. It is considered malicious because: - The...

MAL-2023-8389 Malicious code in @rappiinc/partner-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1077f54b61ad7f744086cdd8c1d66f8d3d7dd074ed0a585b608b4734d3a6f25e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-22077

creationtimestamp| type| source ---|---|--- 2023-10-18 02:44:53+00:00| seen| https://t.me/cibsecurity/72472 2025-08-06 21:02:29+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lvr4oammir25...

Warning: Unpatched Cisco Zero-Day Vulnerability Actively Targeted in the Wild

Cisco has warned of a critical, unpatched security flaw impacting IOS XE software that's under active exploitation in the wild. Rooted in the web UI feature, the zero-day vulnerability is tracked as CVE-2023-20198 and has been assigned the maximum severity rating of 10.0 on the CVSS scoring syste...

CVE-2023-5167

The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting attacks...