376 matches found
Improper Authorization
Overview Affected versions of this package are vulnerable to Improper Authorization over the /auth/listprojects endpoint. A user can perform unauthorized actions beyond their intended permissions by changing the role argument from Viewer to Owner. Remediation There is no fixed version for...
CVE-2025-8794
CVE-2025-8794 affects LitmusChaos Litmus up to version 3.19.0, specifically the LocalStorage Handler. The issue arises from manipulating the projectID argument, causing an authorization bypass. Local access is required to exploit, and public disclosures have been made. Several sources corroborate...
CVE-2025-8794 LitmusChaos Litmus LocalStorage authorization
A vulnerability, which was classified as problematic, has been found in LitmusChaos Litmus up to 3.19.0. Affected by this issue is some unknown functionality of the component LocalStorage Handler. The manipulation of the argument projectID leads to authorization bypass. Local access is required t...
CVE-2025-8792
A vulnerability classified as problematic has been found in LitmusChaos Litmus up to 3.19.0. Affected is an unknown function. The manipulation leads to client-side enforcement of server-side security. It is possible to launch the attack remotely. The exploit has been disclosed to the public and m...
CVE-2025-8791
A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/listprojects. The manipulation of the argument role leads to improper authorization. The attack may be initiated remotely. The exploit has been...
CVE-2025-8793 LitmusChaos Litmus resource injection
A vulnerability classified as problematic was found in LitmusChaos Litmus up to 3.19.0. Affected by this vulnerability is an unknown functionality. The manipulation of the argument projectID leads to improper control of resource identifiers. The attack can be launched remotely. The exploit has be...
CVE-2025-8793
LitmusChaos Litmus up to 3.19.0 is affected by CVE-2025-8793. The vulnerability stems from manipulation of the projectID parameter, causing improper control of resource identifiers in an unknown functionality. It is exploitable remotely and has public PoCs; multiple sources (NVD/NVDC, Red Hat, Sn...
CVE-2025-8792
LitmusChaos (Litmus) up to version 3.19.0 is affected by a vulnerability described as a client‑side enforcement of server‑side security due to an issue in an unknown function. The vulnerability can be exploited remotely, and public exploitation has been disclosed. Multiple sources corroborate the...
CVE-2025-8791
CVE-2025-8791 affects LitmusChaos up to version 3.19.0. The vulnerability is an improper authorization flaw in the /auth/list_projects endpoint caused by manipulating the role parameter, enabling remote, unauthenticated-like actions with low privileges. Exploitation is possible and the exploit ha...
CVE-2025-8791 LitmusChaos Litmus list_projects improper authorization
A vulnerability was found in LitmusChaos Litmus up to 3.19.0. It has been rated as critical. This issue affects some unknown processing of the file /auth/listprojects. The manipulation of the argument role leads to improper authorization. The attack may be initiated remotely. The exploit has been...
LitmusChaos 安全漏洞
LitmusChaos is a program open-sourced by Litmus Chaos that practices chaos engineering in a cloud-native manner. A security vulnerability exists in LitmusChaos 3.19.0 and earlier versions, which stems from improper handling of the parameter projectID, which could lead to improper control of...
Simulating Cyberattacks through a Breach Attack Simulation (BAS) Platform Empowered by Security Chaos Engineering (SCE)
In today digital landscape, organizations face constantly evolving cyber threats, making it essential to discover slippery attack vectors through novel techniques like Security Chaos Engineering SCE, which allows teams to test defenses and identify vulnerabilities effectively. This paper proposes...
Unmasking the new Chaos RaaS group attacks
Cisco Talos Incident Response Talos IR recently observed attacks by Chaos, a relatively new ransomware-as-a-service RaaS group conducting big-game hunting and double extortion attacks. Chaos RaaS actors initiated low-effort spam flooding, escalating to voice-based social engineering for access,...
Fedora 43 : golang-github-projectdiscovery-chaos-client (2025-a6574c5095)
The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a6574c5095 advisory. Automatic update for golang-github-projectdiscovery-chaos-client-0.5.2-1.fc43. Changelog Sun Jul 13 2025 Mikel Olasagasti Uranga - 0.5.2-1 - Update ...
A Group of Young Cybercriminals Poses the ‘Most Imminent Threat’ of Cyberattacks Right Now
The Scattered Spider hacking group has caused chaos among retailers, insurers, and airlines in recent months. Researchers warn that its flexible structure poses challenges for defense...
A Dual-Layer Image Encryption Framework Using Chaotic AES with Dynamic S-Boxes and Steganographic QR Codes
This paper presents a robust image encryption and key distribution framework that integrates an enhanced AES-128 algorithm with chaos theory and advanced steganographic techniques for dual-layer security. The encryption engine features a dynamic ShiftRows operation controlled by a logistic map,...
Chaos RAT Malware Targets Windows and Linux via Fake Network Tool Downloads
Threat hunters are calling attention to a new variant of a remote access trojan RAT called Chaos RAT that has been used in recent attacks targeting Windows and Linux systems. According to findings from Acronis, the malware artifact may have been distributed by tricking victims into downloading a...
A GPS Blackout Would Shut Down the World
GPS jamming and spoofing attacks are on the rise. If the global navigation system the US relies on were to go down entirely, it would send the world into unprecedented chaos...
VulnCheck KEV: CVE-2024-31839
Cross Site Scripting vulnerability in tiagorlampert CHAOS v.5.0.1 allows a remote attacker to escalate privileges via the sendCommandHandler function in the handler.go component...
