PT-2023-36064 · Git +1 · Mongoose

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided description. Description: The issue is related to a crash type of UNKNOWN READ. The crash state includes functions such as skip chunk, http cb, and is located in fuzz.c. No...

New OS Tool Tells You Who Has Access to What Data

Ensuring sensitive data remains confidential, protected from unauthorized access, and compliant with data privacy regulations is paramount. Data breaches result in financial and reputational damage but also lead to legal consequences. Therefore, robust data access security measures are essential ...

Malicious code in @siigo-arquitectura/button-atom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 10fd520d1b3077c01e859228a807bb4d066d090fa3e1d1b287389a9f45d58a78 The OpenSSF Package Analysis project identified '@siigo-arquitectura/button-atom' @ 5.0.7 npm as malicious. It is considered malicious because: ...

The vulnerability of the software for centralized logging, analysis, and storage of logs by Graylog, related to incorrect session duration settings, allows a hacker to intercept a user’s session.

The vulnerability of the Graylog log collection, analysis, and storage software lies in the incorrect duration of the session. Exploiting this vulnerability allows a remote attacker to intercept the user’s session...

Lack of force resume support for LZ which is crucially important to have

Lines of code Vulnerability details Impact The User Application LZReceiver should implement the ILayerZeroUserApplicationConfig interface which includes the forceResumeReceive function. This is very important as in the worst case, it can allow the owner to unblock the queue of messages if somethi...

MAL-2023-8301 Malicious code in @siigo-arquitectura/mf-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 519c8b7461f58c38192ea55bcd67f43659de4537eb6031f1882e2e2dee1acbee The OpenSSF Package Analysis project identified '@siigo-arquitectura/mf-helper' @ 5.0.1 npm as malicious. It is considered malicious because: -...

Malicious code in docupload (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 67162d52cf528df828bdd0efdf7165e3f51fbbbb09d41014c1620d8e1aaecd80 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8293 Malicious code in f0-fpti-tracking-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1ca857aba5d033c511a1378d71e0ac64828687fe8dfef05c287c6d939a148fa4 index.js runs automatically via a preinstall lifecycle hook on npm install and collects host identifiers from the installer's machine — os.hostname,...

Analysis and Config Extraction of Lu0Bot, a Node.js Malware with Considerable Capabilities

Nowadays, more malware developers are using unconventional programming languages to bypass advanced detection systems. The Node.js malware Lu0Bot is a testament to this trend. By targeting a platform-agnostic runtime environment common in modern web apps and employing multi-layer obfuscation,...

A Cybersecurity Risk Assessment Guide for Leaders

Cybersecurity risk assessment provides the continuous asset detection, analysis, prioritization, and risk scoring needed to keep pace with a continuously growing digital attack surface...

MAL-2023-8291 Malicious code in bank_cron (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70064e0fa01accdeb5e78c99cf3b86d47cff2ad6e3bec52c9e45091e600bc5fc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ShellSweep

ShellSweep ShellSweeping the evil Why ShellSweep "Shell...

Incorrect Score calculation in Prime.sol

Lines of code Vulnerability details Impact Score is not calculated correctly; improperly high weight will be given to the staked XVS amount or the supply/borrow amount. Rewards accrued will not be properly calculated, so users may accrue too much or too little reward. Proof of Concept...

MAL-2023-8279 Malicious code in webdriverio-browserstack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 558220ecb7cc65dd1c6bd3cb85413d458fb89da42e9ec16e2e1811a252761b15 The OpenSSF Package Analysis project identified 'webdriverio-browserstack' @ 0.2.0 npm as malicious. It is considered malicious because: - The...

MGASA-2023-0283 Updated chromium-browser-stable package fixes bugs and vulnerabilities

The chromium-browser-stable package has been updated to the 117.0.5938.92 release, fixing bugs and 31 vulnerabilities, together with 117.0.5938.92, 117.0.5938.88, 117.0.5938.62, 116.0.5845.187 and 116.0.5845.179. Google is aware that an exploit for CVE-2023-5217 exists in the wild. High...

Arm Issues Patch for Mali GPU Kernel Driver Vulnerability Amidst Ongoing Exploitation

Arm has released security patches to contain a security flaw in the Mali GPU Kernel Driver that has come under active exploitation in the wild. Tracked as CVE-2023-4211, the shortcoming impacts the following driver versions - Midgard GPU Kernel Driver: All versions from r12p0 - r32p0 Bifrost GPU...

The vulnerability of the Threat Intelligence service of the Nozomi Guardian detection and monitoring network activity tool, as well as the Nozomi Central Management Console (CMC) – a centralized security management tool – allows attackers to carry out cross-site scenario attacks.

The vulnerability of the Threat Intelligence service of the Nozomi Guardian detection and monitoring network activity tool, as well as the Nozomi Central Management Console CMC, relates to the lack of protective measures taken for the web page structure during the processing of threat analysis...

Mozilla Rushes to Fix Critical Vulnerability in Firefox and Thunderbird

By Waqas The vulnerability was reported by Clément Lecigne of Google's Threat Analysis Group TAG. This is a post from HackRead.com Read the original post: Mozilla Rushes to Fix Critical Vulnerability in Firefox and Thunderbird...

MAL-2023-8262 Malicious code in @atbdigitalteam/ui-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2756dc0ffc0a9cddcb70299b7fc1cb3722a348f93647bf237c1f130ecb60ff02 The OpenSSF Package Analysis project identified '@atbdigitalteam/ui-widgets' @ 2.4.1 npm as malicious. It is considered malicious because: - The...

Qualys Named a Market Leader in GigaOm Radar Report for Application Security Testing

Qualys Web Application Scanning WAS has been named a leader in the GigaOm Radar Report for Application Security Testing, 2023. Web app security is critical for every organization, for attacks on this vector caused 25% of breaches, according to the Verizon 2023 Data Breach Investigations Report. T...