CVE-2022-34832

An issue was discovered in VERMEG AgileReporter 21.3. XXE can occur via an XML document to the Analysis component...

PT-2023-13421 · Vermeg · Vermeg Agilereporter

Name of the Vulnerable Software and Affected Versions: VERMEG AgileReporter version 21.3 Description: An issue was discovered in VERMEG AgileReporter where XXE can occur via an XML document to the Analysis component. Recommendations: For VERMEG AgileReporter version 21.3, consider restricting...

Qualys API Best Practices: Web Application Scanning API

This API Best Practices Series is designed for Qualys customer programmers or stakeholders with a general knowledge of programming who want to implement best practices for improving the development, design, and performance of their programs that use the Qualys API. For non-customers, the Qualys A...

An integrated incident response solution with Microsoft and PwC

Today Microsoft Incident Response is excited to announce a new collaboration with PwC to expand our joint incident response and recovery capability. In this global alliance, Microsoft begins the initial containment and investigation, bringing a deep understanding of a company’s infrastructure to...

An integrated incident response solution with Microsoft and PwC

Today Microsoft Incident Response is excited to announce a new collaboration with PwC to expand our joint incident response and recovery capability. In this global alliance, Microsoft begins the initial containment and investigation, bringing a deep understanding of a company’s infrastructure to...

How to catch a wild triangle

In the beginning of 2023, thanks to our Kaspersky Unified Monitoring and Analysis Platform KUMA SIEM system, we noticed suspicious network activity that turned out to be an ongoing attack targeting the iPhones and iPads of our colleagues. The moment we understood that there was a clear pattern in...

Sanction Bypass Through Transferring to another account

Lines of code Vulnerability details Impact Wildcat protocol provides lending with lender backed collateral considered as reserves and the ratio must be upheld by the borrower. WildcatMarketTokens are provided to lenders in return for their base assets, these tokens are ERC20 meaning tokens can be...

CVE-2023-46134

D-Tale is the combination of a Flask back-end and a React front-end to view & analyze Pandas data structures. Prior to version 3.7.0, users hosting D-Tale publicly can be vulnerable to remote code execution, allowing attackers to run malicious code on the server. This issue has been patched in...

H-01 Unmitigated

Lines of code Vulnerability details Mitigation of H-01: Mitigation Error, see comments Link to Issue: code-423n4/2023-09-asymmetry-findings62 Comments The sponsor has provided a detailed response in the following comment: code-423n4/2023-09-asymmetry-findings62 comment In summary their analysis i...

MAL-2023-8398 Malicious code in @tpci/i18next-ext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 14a4fd8041934f617af9e84fb00ca939b961316d3d7b9519c286dd93035801c8 The OpenSSF Package Analysis project identified '@tpci/i18next-ext' @ 1.6.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8397 Malicious code in i18next-ext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4e71c3a73449651c3bbbef4cc540bb5df6e12736e304e95a5a64f2c0c9f55189 The OpenSSF Package Analysis project identified 'i18next-ext' @ 1.6.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in i18next-ext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4e71c3a73449651c3bbbef4cc540bb5df6e12736e304e95a5a64f2c0c9f55189 The OpenSSF Package Analysis project identified 'i18next-ext' @ 1.6.0 npm as malicious. It is considered malicious because: - The package...

Blockforia: A Comprehensive Analysis of a Prominent Cryptocurrency Exchange

By Owais Sultan Blockforia functions as a cryptocurrency exchange firmly grounded within the regulatory purview of the European Union. This is a post from HackRead.com Read the original post: Blockforia: A Comprehensive Analysis of a Prominent Cryptocurrency Exchange...

Analysis: A Ransomware Attack on a PostgreSQL Database

In 2017, we reported on a database ransomware campaign targeting MySQL and MongoDB. Since then, we’ve observed similar attack tactics on a PostgreSQL database in Imperva Threat Research lab. In general, the attack flow contained: A brute force attack on the database for known users and weak...

Ashlar-Vellum Cobalt, Graphite, Xenon, Argon, Lithium (Update A)

View CSAF 1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION : Low attack complexity Vendor : Ashlar-Vellum Equipment : Cobalt, Graphite, Xenon, Argon, Lithium, and Cobalt Share Vulnerabilities : Out-of-Bounds Write, Heap-based Buffer Overflow, Out-of-Bounds Read 2. RISK EVALUATION Successful...

Exploit for Insufficient Verification of Data Authenticity in Rarlab Winrar

CVE-2023-38831 CVE-2023-38831 is an RCE in WinRAR 6.23...

Malicious code in fbdebug (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2edf3045263e059e2b1599655b25cc167abecc4d1e77e5e7e8d62998b0fd9e18 The OpenSSF Package Analysis project identified 'fbdebug' @ 0.1 pypi as malicious. It is considered malicious because: - The package communicate...

Malicious code in billing.api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 507cfdb034cfdde119a280e16b6ad66952ff26fd821fd25ec866bf04f29398f1 The OpenSSF Package Analysis project identified 'billing.api' @ 2.0.0 npm as malicious. It is considered malicious because: - The package...

HCL Technologies AppScan Presence Elevation of Privilege Vulnerability

HCL Technologies AppScan Presence is a suite of dynamic analysis testing tools from HCL Technologies, USA, which is mainly used for Web security testing. An elevation of privilege vulnerability exists in HCL Technologies AppScan Presence, which stems from the presence of an un-referenced service...

Malicious code in ux-website (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1ed957b968f0d201b3698f9027b13297541196d608edb84f496f3262569e5a81 The OpenSSF Package Analysis project identified 'ux-website' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...