MAL-2023-1493 Malicious code in postman-zendesk-support-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3501f72f7b7c1700a90f7ad5e3a55cd2462c210637c68dc75f9d336e9bf0063 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in f0-data-constructor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23fc7101aab5c7172a2ab40e0e1ce62dbd251d5301f5efb5f4c30cab065bb5cd The package's preinstall hook auto-executes index.js on npm install. The script imports https and os, collects os.hostname, os.platform, os.arch,...

MAL-2023-1491 Malicious code in f0-data-constructor (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 23fc7101aab5c7172a2ab40e0e1ce62dbd251d5301f5efb5f4c30cab065bb5cd The package's preinstall hook auto-executes index.js on npm install. The script imports https and os, collects os.hostname, os.platform, os.arch,...

Guide: How Google Workspace-based Organizations can leverage Chrome to improve Security

More and more organizations are choosing Google Workspace as their default employee toolset of choice. But despite the productivity advantages, this organizational action also incurs a new security debt. Security teams now have to find a way to adjust their security architecture to this new cloud...

MAL-2023-1474 Malicious code in infima-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcc026f6dfc120957923bfddc830c588da513981ea2aed8e761a04719a8454bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1483 Malicious code in spark-math (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b69ba236f6e65c975d31bbd86381ca28f0abc32e518869dbc220b8cfe2c526e6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in micro-module-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 84ee1d3926358ce600863901c33d5bbd13bbc4703092dcfd628bf0e6958b256c The OpenSSF Package Analysis project identified 'micro-module-test' @ 40.32.2 npm as malicious. It is considered malicious because: - The packag...

MAL-2023-1472 Malicious code in micro-module-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 84ee1d3926358ce600863901c33d5bbd13bbc4703092dcfd628bf0e6958b256c The OpenSSF Package Analysis project identified 'micro-module-test' @ 40.32.2 npm as malicious. It is considered malicious because: - The packag...

CVE-2023-38898

creationtimestamp| type| source ---|---|--- 2023-08-15 20:30:46+00:00| seen| https://t.me/cibsecurity/68549...

Malicious code in snapchat-test-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74175a7cb8d558510ee0b14523be60015ccb0796614898009692f129fd8f996f The OpenSSF Package Analysis project identified 'snapchat-test-package' @ 1.0.1 npm as malicious. It is considered malicious because: - The...

CVE-2023-21231

In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exported or permission-protected activity due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2023-21229

In registerServiceLocked of ManagedServices.java, there is a possible bypass of background activity launch restrictions due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Design/Logic Flaw

In registerServiceLocked of ManagedServices.java, there is a possible bypass of background activity launch restrictions due to an unsafe PendingIntent. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

CVE-2023-21134

In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been factory reset with no additional execution privileges needed...

CVE-2023-21133

In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been factory reset with no additional execution privileges needed...

CVE-2023-21132

In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been factory reset with no additional execution privileges needed...

CVE-2023-21229

CVE-2023-21229 concerns Google Wear OS (Framework/ManagedServices.java: registerServiceLocked) where an unsafe PendingIntent can bypass background activity launch restrictions. This vulnerability enables local escalation of privilege with no additional privileges and no user interaction required,...

CVE-2023-21231

In getIntentForButton of ButtonManager.java, there is a possible way for an unprivileged application to start a non-exported or permission-protected activity due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2023-3435

The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks...

CVE-2023-3435

The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks...