MAL-2022-4117 Malicious code in katt-blueprint-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cdbbe344f9bbe3c02a30721cb02fa4b35a267f38226c55eee6745057af1da1ca Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tslint-blueprint-palantir (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9f64a2db0936cb6851f198d5c96fdbec01b8f09506dca325469623d0b6df8fc1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross-site scripting (XSS) from field and configuration text displayed in the Panel

On Saturday, @hdodov reported that the Panel's ListItem component used in the pages and files section for example displayed HTML in page titles as it is. This could be used for cross-site scripting XSS attacks. We used his report as an opportunity to find and fix XSS issues related to dynamic sit...

Symphony CMS Cross-Site Scripting Vulnerability (CNVD-2020-49577)

Symphony CMS is a PHP + MySQL based , using XML and XSLT as the backbone of the open source content management system . A cross-site scripting vulnerability exists in content/content.blueprintsevents.php in Symphony CMS 3.0.0. The vulnerability can be exploited by an attacker to conduct a...

SQL Injection Vulnerability in Website Building System of Zhongshan Blueprint Network Technology Co.

Zhongshan Blueprint Network Technology Co., Ltd. is a provider specializing in construction as well as program development. There is a SQL injection vulnerability in the website building system of Zhongshan Blueprint Network Technology Co., Ltd, which can be exploited by attackers to obtain...

CVE-2019-19032

XMLBlueprint through 16.191112 is affected by XML External Entity Injection. The impact is: Arbitrary File Read when an XML File is validated. The component is: XML Validate function. The attack vector is: Specially crafted XML payload...

A week in security (October 29 – November 4)

Last week on Malwarebytes Labs, we looked at a rogue cryptocurrency app installing backdoors, took a dive into the world of printer security, explored browser privacy tweaks, highlighted a music festival–themed breach, and introduced Malwarebytes for Chromebook. Other cybersecurity news Memory...

The First Step to Deploying Application Control

Application Control remains one of the best techniques for blocking the vast majority of malware threats; however, implementation often falters due to poor planning. Gartner How to Successfully Deploy Application Control Is Whitelisting Worth It? When it comes to preventing new attacks,...

Security Bulletin: Multiple IBM InfoSphere Information Server components are vulnerable due to the following Castor Library vulnerability (CVE-2014-3004)

Summary Castor Library could allow a remote attacker to obtain sensitive information in various IBM Information Server components. This is caused by an XML External Entity Injection XXE error when processing XML data. By sending specially-crafted XML data, an attacker could exploit this...

655,000 Healthcare Records Being Sold on Dark Web

A hacker selling upwards to 655,000 healthcare records on the dark web allegedly obtained them after exploiting a vulnerability in how companies implement remote desktop protocol, or RDP, functionality. The hacker, who goes by the handle “thedarkoverlord,” allegedly penetrated three healthcare...

XSS vulnerability in 'Share a link' blueprint

Open the Create dialog - Select "Share a Link" article - In the 'Topics' field, enter an attack string such as: alert"hello" =The script will be executed...

Ross Klein (Starwood Hotels and Resorts Worldwide)

Klein and Amar Lalvani were two top executives at the Starwood hotel chain when they were recruited by Starwood’s chief competitor, Hilton, to help it start a new line of “lifestyle” hotels to compete with Starwood’s popular “W” hotels. According to a lawsuit filed by Starwood, the two executives...