MAL-2024-9290 Malicious code in @client-innovation/librct (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1a2f5c07d4afdd35b9ab57b79e56cc5fb4691cf41b012b5c2dc63c13369a235a The OpenSSF Package Analysis project identified '@client-innovation/librct' @ 100.100.0 npm as malicious. It is considered malicious because: -...

What Are Normal Users Supposed to Do with IDS Alerts from Network Gear?

Probably once a week, I see posts like this in the r/Ubiquiti subreddit. Ubiquiti makes network gear that includes an "IDS/IPS" feature. I own some older Ubiquiti gear so I am familiar with the product. When you enable this feature, you get alerts like this one, posted by a Redditor: This is...

Akamai’s Perspective on October’s Patch Tuesday 2024

...

OSV-2024-1200 UNKNOWN READ in eat_line

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=372515100 Crash type: UNKNOWN READ Crash state: eatline extractfield parsesdpsession...

Malicious code in @copilot-web-widgets/ai-writer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 370d6b958dcc6a556f2ee4be3946c6a1a995bb05d4217f408f2302dd397689a2 The OpenSSF Package Analysis project identified '@copilot-web-widgets/ai-writer' @ 1.13.1 npm as malicious. It is considered malicious because: ...

MAL-2024-9212 Malicious code in @copilot-web-widgets/common-core-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 148c6b43da3f4ec787aa611cf721a390eab6918627604a9405d817955e2c472b The OpenSSF Package Analysis project identified '@copilot-web-widgets/common-core-sdk' @ 1.11.0 npm as malicious. It is considered malicious...

SpyCloud Adds Identity Analytics to Cybercrime Investigation Solution for Insider Risk

Austin, TX, USA, 10th October 2024, CyberNewsWire...

MAL-2024-9211 Malicious code in manoj-app-css-alt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0c88dab3b32782f38a2c1b962d842f1c4c52400df0c5622d73f4989ebc8381f6 The OpenSSF Package Analysis project identified 'manoj-app-css-alt' @ 9.1.1 npm as malicious. It is considered malicious because: - The package...

Rockwell Automation Logix Controllers

View CSAF 1. EXECUTIVE SUMMARY CVSS v4 8.7 ATTENTION : Exploitable remotely/low attack complexity Vendor : Rockwell Automation Equipment : Compact GuardLogix, CompactLogix, ControlLogix, GuardLogix, 1756-EN4TR Vulnerability : Uncontrolled Resource Consumption 2. RISK EVALUATION Successful...

Schneider Electric Zelio Soft 2

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Exploitable remotely/low attack complexity Vendor : Schneider Electric Equipment : Zelio Soft 2 Vulnerabilities : Use After Free, Improper Input Validation 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an...

Wireshark 安全漏洞

Wireshark formerly known as Ethereal is a suite of network packet analysis software from the Wireshark team. The function of the software is to intercept network packets and display detailed data for analysis. A security vulnerability exists in Wireshark version 4.4.0, which stems from a crash in...

OSV-2024-1191 Security exception in org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=371931330 Crash type: Security exception Crash state: org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII org.apache.lucene.analysis.miscellaneous.ASCIIFoldingFilter.foldToASCII...

CentOS 7 : kernel-alt (RHSA-2020:0174)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2020:0174 advisory. - In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanoutadd from setsockopt and bind on an AFPACKET socket...

MAL-2024-9110 Malicious code in sd-template-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b1d800f01a52aafc7bee8ab45032560696e9e36ca3c902a4adc7d1245294fc0e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9109 Malicious code in msdhsfhjfj-cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 932d9efe887d64209a4ce155d5f224a976b49eb001d725016073b83f2d8b3bcd The OpenSSF Package Analysis project identified 'msdhsfhjfj-cli' @ 9.4.1 npm as malicious. It is considered malicious because: - The package...

New Case Study: The Evil Twin Checkout Page

Is your store at risk? Discover how an innovative web security solution saved one global online retailer and its unsuspecting customers from an "evil twin" disaster. Read the full real-life case study here. The Invisible Threat in Online Shopping When is a checkout page, not a checkout page? When...

MAL-2024-9106 Malicious code in @fdp-tools/helm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bef4a02ea616732eda209303ce418b0fbf07d43995a8ac48bada7b7967f78819 The OpenSSF Package Analysis project identified '@fdp-tools/helm' @ 0.1.11 npm as malicious. It is considered malicious because: - The package...

Malicious code in @fdp-tools/observability (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3470fe72252929511b982b06c857fe2d4c8030b512a880c9bc15a088be17c838 The OpenSSF Package Analysis project identified '@fdp-tools/observability' @ 1.1.3 npm as malicious. It is considered malicious because: - The...

MAL-2024-9103 Malicious code in @fdp-tools/artifactory (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7d1bc272c51a6ad1997aaaa84623c7746d308a5e53386e01c6845e1b849c7ffa The OpenSSF Package Analysis project identified '@fdp-tools/artifactory' @ 0.0.10 npm as malicious. It is considered malicious because: - The...

Siemens HiMed Cockpit

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens' ProductCERT Security Advisories CERT Services | Services |...