Modular Java Backdoor Dropped in Cleo Exploitation Campaign

Many thanks to Rapid7 MDR and incident response teams for their contributions to this analysis. While investigating incidents related to Cleo software exploitation, Rapid7 Labs and MDR observed a novel, multi-stage attack that deploys an encoded Java Archive JAR payload. Our investigation reveale...

Modular Java Backdoor Dropped in Cleo Exploitation Campaign

Many thanks to Rapid7 MDR and incident response teams for their contributions to this analysis. While investigating incidents related to Cleo software exploitation, Rapid7 Labs and MDR observed a novel, multi-stage attack that deploys an encoded Java Archive JAR payload. Our investigation reveale...

Malicious code in goworker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc41b31c8374e8dfb0d1a61187a9224907fd3adc6b4988f7285c3ab45891a807 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11783 Malicious code in goworker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc41b31c8374e8dfb0d1a61187a9224907fd3adc6b4988f7285c3ab45891a807 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @aoflmkt/app-call (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7ceabbeb0d20f6267c8883498e7c31aa52148eff458969a12d2397d930978d85 The OpenSSF Package Analysis project identified '@aoflmkt/app-call' @ 100.100.106 npm as malicious. It is considered malicious because: - The...

Malicious code in blacky-sheppoing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd5fabc8fe73f97f7fe5b3fc0d6bcb5d30d10325cdc85801ff4b38f51112d597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11779 Malicious code in blacky-sheppoing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bd5fabc8fe73f97f7fe5b3fc0d6bcb5d30d10325cdc85801ff4b38f51112d597 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The vulnerability of the NFC component in the Linux operating system’s kernel allows a hacker to trigger a service failure.

The vulnerability of the NFC component in the Linux operating system’s kernel is related to the pointer NULL operation. Exploiting this vulnerability can allow an attacker to trigger a service failure...

Malicious code in error-stack-parsersasasa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 95ee2924307d088b5e7509bfa51de2136a5611527d0de92d5ea4020f7ba0edf0 The OpenSSF Package Analysis project identified 'error-stack-parsersasasa' @ 1.2.7 npm as malicious. It is considered malicious because: - The...

CVE-2024-54005

A vulnerability has been identified in COMOS V10.3 All versions V10.3.3.5.8, COMOS V10.4.0 All versions, COMOS V10.4.1 All versions, COMOS V10.4.2 All versions, COMOS V10.4.3 All versions V10.4.3.0.47, COMOS V10.4.4 All versions V10.4.4.2, COMOS V10.4.4.1 All versions V10.4.4.1.21. The PDMS/E3D...

CVE-2024-54005

A vulnerability has been identified in COMOS V10.3 All versions V10.3.3.5.8, COMOS V10.4.0 All versions, COMOS V10.4.1 All versions, COMOS V10.4.2 All versions, COMOS V10.4.3 All versions V10.4.3.0.47, COMOS V10.4.4 All versions V10.4.4.2, COMOS V10.4.4.1 All versions V10.4.4.1.21. The PDMS/E3D...

Malicious code in dexter123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92153d5ec8ca742a1abda5dd5a05def8deace56614101ebb7f38980a9583769a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11757 Malicious code in dexter123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 92153d5ec8ca742a1abda5dd5a05def8deace56614101ebb7f38980a9583769a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-50928

Insecure permissions in Silicon Labs SiLabs Z-Wave Series 700 and 800 v7.21.1 allow attackers to change the wakeup interval of end devices in controller memory, disrupting the device's communications with the controller...

PT-2024-34457 · Silicon · Z-Wave Series 700/800

Name of the Vulnerable Software and Affected Versions: Silicon Labs SiLabs Z-Wave Series 700 and 800 version 7.21.1 Description: The issue is related to insecure permissions in the affected software, allowing attackers to disrupt communications between the controller and the device by repeatedly...

CVE-2024-50924

CVE-2024-50924 concerns Silicon Labs Z-Wave Series 700 and 800 devices with firmware version 7.21.1. Multiple connected sources describe insecure permissions as the underlying issue, enabling an attacker to disrupt communications between the controller and the device by repeatedly sending special...

CVE-2024-50924

Insecure permissions in Silicon Labs SiLabs Z-Wave Series 700 and 800 v7.21.1 allow attackers to cause disrupt communications between the controller and the device itself via repeatedly sending crafted packets to the controller...

MAL-2024-11755 Malicious code in @neo-ds/neo-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6d3d5e2f6b432e3a4491b74a6c06d176dcf93aa9cf419db326cea281b530044b The OpenSSF Package Analysis project identified '@neo-ds/neo-utils' @ 3.3.7 npm as malicious. It is considered malicious because: - The package...

Malicious code in promisified-resource-pool123 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3a42e7d4fdb14241d0b230905da182d6726bba306ef7dc7cbd565eadf2192e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11773 Malicious code in playwright-1.46 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1b54a73f91f92e3252ca7711496e9a2cc0e1eabd2637f94a2bfdce96d1a94791 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...