Malicious code in not-a-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f65b9ef7e604f803f7ac9a09d7948911e9cde5f1033f969f2438c8422d48dd22 The OpenSSF Package Analysis project identified 'not-a-math' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

As a sys admin user without permissions to view a restricted space, I can see activity for it but cannot view the space or pages in it

h3. Issue Summary This is reproducible on Data Center: YES. h3. Steps to Reproduce h4. Steps on Bulldog: Sign in as a user with all of these permissions: Can Use, Personal Space, Create Spaces, Confluence Administrator optional, System Administrator. Note that this use should not be present in th...

MAL-2023-8120 Malicious code in @healthbridge-design-system/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 67a89e843273447a99a5bf30226772af73acc28ebaa30abad7579f363b87e848 The OpenSSF Package Analysis project identified '@healthbridge-design-system/components' @ 1.0.0 npm as malicious. It is considered malicious...

MAL-2023-8115 Malicious code in mfp-food-diary (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 922a2a2aa1e588af220ee7d7266ea604a14e5dfa4c43ef09d3248c3d3adc1250 The OpenSSF Package Analysis project identified 'mfp-food-diary' @ 0.1.2 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8112 Malicious code in producer-journey (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b44a983bac4bf4a84c490b2164cbf0dddd7dadf964ab05e400ae579c5c8c50b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8110 Malicious code in adidas-data-mesh (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdd001e6013b356683b2fea45497d02787519396582fbe22102e0618a79380fe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-41325

creationtimestamp| type| source ---|---|--- 2023-09-16 00:25:49+00:00| seen| https://t.me/cibsecurity/70616...

MAL-2023-8103 Malicious code in sharinj-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c38a5716c52678eb97b3b338a62f683268c28460657955b8ef607ef45c57a8cf The OpenSSF Package Analysis project identified 'sharinj-test' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Peach Sandstorm password spray campaigns enable intelligence collection at high-value targets

Since February 2023, Microsoft has observed password spray activity against thousands of organizations carried out by an actor we track as Peach Sandstorm HOLMIUM. Peach Sandstorm is an Iranian nation-state threat actor who has recently pursued organizations in the satellite, defense, and...

CVE-2023-3301

creationtimestamp| type| source ---|---|--- 2023-09-13 20:23:54+00:00| seen| https://t.me/cibsecurity/70405 2025-09-05 09:50:30+00:00| seen| https://bsky.app/profile/2rZiKKbOU3nTafniR2qMMSE0gwZ.activitypub.awakari.com.ap.brid.gy/post/3ly3eytayuc72 2025-09-05 09:50:31+00:00| seen|...

CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

CVE-2023-42468

The com.cutestudio.colordialer application through 2.1.8-2 for Android allows a remote attacker to initiate phone calls without user consent, because of improper export of the com.cutestudio.dialer.activities.DialerActivity component. A third-party application without any permissions can craft an...

CVE-2023-42469

The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.full.dialer.top.secure.encrypted.activities.DialerActivity component...

CVE-2023-42469

The com.full.dialer.top.secure.encrypted application through 1.0.1 for Android enables any installed application with no permissions to place phone calls without user interaction by sending a crafted intent via the com.full.dialer.top.secure.encrypted.activities.DialerActivity component...

Malicious code in smeeh-administration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9498162a94b3baa19086d8a3b158e7b37ed534cca2d6bc1a6e04f2749d18f28d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8097 Malicious code in purplebricks-administration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 166a338cbf2061c2c522db795a33313847ac718197150d27111861792523592c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2023-28358 · Unknown · Com.Cutestudio.Colordialer

Name of the Vulnerable Software and Affected Versions: com.cutestudio.colordialer versions 2.1.8-2 and earlier Description: The issue allows a remote attacker to initiate phone calls without user consent due to improper export of the com.cutestudio.dialer.activities.DialerActivity component. A...

Attacks, Vulnerabilities and Actors 4 September to 10 September 2023

For a detailed threat digest, download the pdf file here Summary HiveForce Labs has recently made several significant discoveries related to cybersecurity threats. Over the past week, we identified a total of ten executed attacks, one instance of adversary activity, and six vulnerabilities...

CVE-2023-35676

In createQuickShareAction of SaveImageInBackgroundTask.java, there is a possible way to trigger a background activity launch due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-35674

In onCreate of WindowState.java, there is a possible way to launch a background activity due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...