Malicious code in @toloka-tb/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c655dc69b310808896f252e5607b9dd8c4bd54b9d139caa655f5816f2269abd4 The OpenSSF Package Analysis project identified '@toloka-tb/core' @ 2.5.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in sc-meta-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e8afeccfd77a3b36e9c24aa1057807ba8f2a18972791b3cbc857e3d961e60d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10328 Malicious code in sc-meta-layer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8e8afeccfd77a3b36e9c24aa1057807ba8f2a18972791b3cbc857e3d961e60d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10329 Malicious code in sc-pattern-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6cbcdc7facabe72ef42307c4747ea188fbeec7c3f4f2203bfab0770204dc01c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in creative_design_client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 15b9d3a4ef8f0a22d5ff21957427271795b4aa88024b5746a06181ae5918235a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

From Naptime to Big Sleep: Using Large Language Models To Catch Vulnerabilities In Real-World Code

Posted by the Big Sleep team Introduction In our previous post, Project Naptime: Evaluating Offensive Security Capabilities of Large Language Models, we introduced our framework for large-language-model-assisted vulnerability research and demonstrated its potential by improving the state-of-the-a...

Announcing TotalCloud Attack Path, Cloud Workflow Automation, and 3-Step Simplified User Onboarding for Qualys TotalCloud CNAPP

The shift of business applications and infrastructure to the cloud has heightened the need for security teams to manage cyber risks comprehensively, ensuring visibility and control across diverse cloud environments. As organizations increasingly adopt multi-cloud environments, they often find...

MAL-2024-10299 Malicious code in @amagioss/js-timecode (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cd0e634cb711f3c81ba053e00875d83653e7f7f70757ace4e3234b538bc5c88 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10273 Malicious code in cms-ti-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7100910eea49836b4baf265c4f34b2964d486d5f305a31fc08cb57bf04ce96d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10272 Malicious code in cms-hpti-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e35f9a2795b7a81d170feae4580fb5fab3f60a4f289259701395afe3031d0996 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Exploit for CVE-2024-38821

cve-2024-38821 Analysis: h...

MAL-2024-10269 Malicious code in @wf-wfria/ria-analytics (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6704722f829f142a06f1ec217b553b1824ff3b10d283dbe1a492b45c100859d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in test-package2345 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 376f2c62728c1d9f82712acd63e4377bd525a0faae2b00a7746dd322c8e5379d The OpenSSF Package Analysis project identified 'test-package2345' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in orb-sync-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 66fd78c3bd4a6a0c78fd807883122d9472771728d739f90d169cd1ba62760f3c The OpenSSF Package Analysis project identified 'orb-sync-lib' @ 100.0.0 npm as malicious. It is considered malicious because: - The package...

SAS Studio 安全漏洞

SAS Studio is a Web browser-based programming environment from SAS. A security vulnerability exists in SAS Studio version 9.4. A remote attacker could exploit the vulnerability to access internal files by manipulating the default path during file download...

The vulnerability of the detection mechanism for network traffic analysis tools, network detection, and response by Palo Alto Networks’ Cortex XDR Agent on Windows operating systems allows attackers to disable the Cortex XDR Agent and execute arbitrary code.

The vulnerability of the detection mechanism for network traffic analysis, network detection, and response by Palo Alto Networks’ Cortex XDR Agent in Windows operating systems is related to insufficient checking of unusual or exceptional states. Exploiting this vulnerability could allow an attack...

MAL-2024-10282 Malicious code in ui-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4ec8e71cd55c69aa20854cfdc8a408f5591d35551b0d09cfa0bbdd9f148a7401 The OpenSSF Package Analysis project identified 'ui-tooltip' @ 1.1.2 npm as malicious. It is considered malicious because: - The package...

Malicious code in ui-tooltip (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4ec8e71cd55c69aa20854cfdc8a408f5591d35551b0d09cfa0bbdd9f148a7401 The OpenSSF Package Analysis project identified 'ui-tooltip' @ 1.1.2 npm as malicious. It is considered malicious because: - The package...

Law Enforcement Deanonymizes Tor Users

The German police have successfully deanonymized at least four Tor users. It appears they watch known Tor relays and known suspects, and use timing analysis to figure out who is using what relay. Tor has written about this. Hacker News thread...

Solar-Log Base 15

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 5.1 ATTENTION : Exploitable remotely/low attack complexity/public exploits are available Vendor : Solar-Log Equipment : Base 15 Vulnerability : Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' 2. RISK EVALUATION Successful...