Ransomware review: August 2023

This article is based on research by Marcelo Rivero, Malwarebytes' ransomware specialist, who monitors information published by ransomware gangs on their Dark Web sites. In this report, "known attacks" are those where the victim did not pay a ransom. This provides the best overall picture of...

Malicious code in puppet-module-posix-system-r3.2 (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 835ce606cd37fa823a80a445ab30dce0ec0005af3a78f9ed7a8d35d63db99474 The OpenSSF Package Analysis project identified 'puppet-module-posix-system-r3.2' @ 1.0.0 rubygems as malicious. It is considered malicious...

Malicious code in eslint-config-ironfish (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3c131e05243f24fb2099561dacc47fb3017389f480a323ac185ed3271a6907de The OpenSSF Package Analysis project identified 'eslint-config-ironfish' @ 99.3.0 npm as malicious. It is considered malicious because: - The...

WordPress User Activity Log Plugin <= 1.6.5 is vulnerable to Broken Access Control

Software User Activity Log Type Plugin Vulnerable versions = 1.6.5 Fixed in 1.6.6 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4bfc0a7fe11d Credits WordFence Required privilege...

WordPress User Activity Tracking and Log Plugin < 4.0.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software User Activity Tracking and Log Type Plugin Vulnerable versions 4.0.9 Fixed in 4.0.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4150 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8eda0dc496af Credits Erwan L...

Malicious code in govinda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a146f02f67219a9fce8688b26d78fe74c7b2adccbf6ea61812d0d0c1d6caeaf1 The OpenSSF Package Analysis project identified 'govinda' @ 1.0.2 npm as malicious. It is considered malicious because: - The package communicat...

MAL-2023-1187 Malicious code in govinda (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a146f02f67219a9fce8688b26d78fe74c7b2adccbf6ea61812d0d0c1d6caeaf1 The OpenSSF Package Analysis project identified 'govinda' @ 1.0.2 npm as malicious. It is considered malicious because: - The package communicat...

User Activity Tracking and Log < 4.0.9 - License Update/Deactivation via CSRF

Description The plugin does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF attacks Make a logged in admin open a page with the code below To make them deactivate the license To make th...

Information Disclosure

firefox and thunderbird are vulnerable to Information Disclosure. An attacker could exploit this vulnerability by creating a malicious website that would contain a specially crafted off-screen canvas element. When the victim visited the website, the off-screen canvas element would be able to acce...

Information Disclosure

chromium is vulnerable to Information Disclosure. This vulnerability occurs when Chrome parses a specially crafted HTML page that contains a Custom Tabs link. If the page is valid, Chrome could be tricked into opening the link in a non-default Custom Tab which could allow the attacker to track th...

MAL-2023-1058 Malicious code in infocaster-frontend-bootstrap-4-starter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c55745943f07b53663bfc73b3b50663ca02b9b94e8897b082272ea0be460c533 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1092 Malicious code in @n9xcnr5test/n9xcnr5 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 98235bbf40ea66c28973775cba8ead37bb4dc1d8999e5ebf02eb3157d4ba74be The OpenSSF Package Analysis project identified '@n9xcnr5test/n9xcnr5' @ 2001.0.0 npm as malicious. It is considered malicious because: - The...

CVE-2023-34038

creationtimestamp| type| source ---|---|--- 2023-08-04 17:25:01+00:00| seen| https://t.me/cibsecurity/67758...

Malicious code in twodc-visualizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a8320b928ec8230835a771ef3d18a7751bbf07d1ea39585419f48e7d5c41a9cd The OpenSSF Package Analysis project identified 'twodc-visualizer' @ 1.6.3 npm as malicious. It is considered malicious because: - The package...

Researchers Uncover AWS SSM Agent Misuse as a Covert Remote Access Trojan

Cybersecurity researchers have discovered a new post-exploitation technique in Amazon Web Services AWS that allows the AWS Systems Manager Agent SSM Agent to be run as a remote access trojan on Windows and Linux environments "The SSM agent, a legitimate tool used by admins to manage their...

MAL-2023-1031 Malicious code in command-launcher (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9a7b891d069224249cbc33b96113ab88f41f6eb292cb9a94e8232641a2e2ddf9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-1030 Malicious code in coinbase-wallet-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1892cfeefb3909aa3aed58c0112f2bc9fcb0a762f2242e57c991846a6b8bc875 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stranger-strings-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0eb204bfcf29270cc49274f3388170c77d866c2f6e0a88d4336c01732a365768 The OpenSSF Package Analysis project identified 'stranger-strings-functions' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1307 Malicious code in stranger-strings-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0eb204bfcf29270cc49274f3388170c77d866c2f6e0a88d4336c01732a365768 The OpenSSF Package Analysis project identified 'stranger-strings-functions' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-1186 Malicious code in globalhackaton (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 585c6a5aa662d1fe0955c6b5809ed637b16addeddae6ad5d00010547c0d4ae63 The OpenSSF Package Analysis project identified 'globalhackaton' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...