Worried About Bot Attacks on B2C APIs? You May Be Missing a Bigger Risk

...

WordPress Marketing Twitter Bot Plugin <= 1.11 is vulnerable to Cross Site Scripting (XSS)

Software Marketing Twitter Bot Type Plugin Vulnerable versions = 1.11 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-7197 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 895d16e82fa5 Credits Daniel Ruf Required...

CVE-2024-22309

Deserialization of Untrusted Data vulnerability in QuantumCloud ChatBot with AI.This issue affects ChatBot with AI: from n/a through 5.1.0...

NS-STEALER Utilizes Discord Bots for Covert Exfiltration of Sensitive Data

Summary: A recently discovered Java-based information stealer, named NS-STEALER, employs a Discord bot channel as an EventListener to exfiltrate sensitive data from compromised hosts. This malware is distributed through ZIP archives that disguise themselves as cracked software. Threat Level - Amb...

Marketing Twitter Bot <= 1.11 - Settings Update to Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Have an admin open an HTML page containing the following: ' document.forms0.submit;...

Marketing Twitter Bot <= 1.11 - Settings Update to Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack PoC Have an admin open an HTML page containing the following:...

NS-STEALER Uses Discord Bots to Exfiltrate Your Secrets from Popular Browsers

Cybersecurity researchers have discovered a new Java-based "sophisticated" information stealer that uses a Discord bot to exfiltrate sensitive data from compromised hosts. The malware, named NS-STEALER, is propagated via ZIP archives masquerading as cracked software, Trellix security researcher...

CVE-2023-47034

A vulnerability in UniswapFrontRunBot 0xdB94c allows attackers to cause financial losses via unspecified vectors...

PT-2024-13403 · Unknown · Uniswapfrontrunbot

Name of the Vulnerable Software and Affected Versions: UniswapFrontRunBot version 0xdB94c Description: A vulnerability in UniswapFrontRunBot allows attackers to cause financial losses via unspecified vectors. Recommendations: At the moment, there is no information about a newer version that...

Ethereum blockchain security breach

Ethereum Blockchain is a decentralized open source public blockchain platform with smart contract capabilities from the Ethereum Foundation. A security vulnerability exists in Ethereum blockchain that stems from incorrect access control contained in UniswapFrontRunBot, which could lead to financi...

JAVA-based Sophisticated Stealer Using Discord Bot as EventListener

JAVA-Based Sophisticated Stealer Using Discord Bot as EventListener By Trellix · January 18, 2024 This blog was written by Gurumoorthi Ramanathan Executive Summary: In mid-November 2023, Trellix Advanced Research Center team members observed a Java-based stealer being spread through cracked...

JAVA-based Sophisticated Stealer Using Discord Bot as EventListener

JAVA-Based Sophisticated Stealer Using Discord Bot as EventListener By Gurumoorthi Ramanathan · January 18, 2024 Executive Summary: In mid-November 2023, Trellix Advanced Research Center team members observed a Java-based stealer being spread through cracked software zip files using JDABuilder...

MAL-2024-129 Malicious code in uptime-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a0e113f69232b20a00d710578e5aa983b5229e1eee46b549cecfd774a03e25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in uptime-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b8a0e113f69232b20a00d710578e5aa983b5229e1eee46b549cecfd774a03e25 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in discord.js-seifbot-v13 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 18888cbfd68f5ec50d2e482047ecc3917d6697a0283a591eb8e33d8a2095a784 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

VulnCheck KEV: CVE-2023-51409

Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98...

CVE-2024-21663

Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability h...

CVE-2024-21663 Remote code execution on ReconServer due to improper input sanitization on the prips command

Discord-Recon is a Discord bot created to automate bug bounty recon, automated scans and information gathering via a discord server. Discord-Recon is vulnerable to remote code execution. An attacker is able to execute shell commands in the server without having an admin role. This vulnerability h...

CVE-2023-38623

creationtimestamp| type| source ---|---|--- 2024-01-08 16:32:17+00:00| seen| https://t.me/ctinow/164461 2024-01-11 08:16:25+00:00| seen| https://t.me/ctinow/166341...

Malicious code in vg-bot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d995efbd124e2109bc610be152ba4a331cb7d256d3a70d5df78498e416cffbc7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...