1371 matches found
CVE-2024-51498
CVE-2024-51498 affects cobalt, specifically versions prior to 10.2.1. A malicious cobalt instance could serve links with the javascript: protocol, causing Cross-site Scripting (XSS) when a user downloads an item from a picker. Root cause: links delivered in the picker flow can execute script due ...
CVE-2024-51498 [@imput/cobalt-web] Cross-site Scripting when downloading picker image from malicious instance
cobalt is a media downloader that doesn't piss you off. A malicious cobalt instance could serve links with the javascript: protocol, resulting in Cross-site Scripting XSS when the user tries to download an item from a picker. This issue has been present since commit 66bac03e, was mitigated in...
cobalt 跨站脚本漏洞
cobalt is an imput open source media downloader. A cross-site scripting vulnerability exists in cobalt that stems from the fact that a malicious instance of cobalt may provide links using the javascript protocol, which can lead to cross-site scripting XSS when a user attempts to download items fr...
WordPress APK Downloader plugin <= 1.0.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability
CSRF to Stored Cross Site Scripting XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin APK Downloader versions = 1.0.0...
WordPress APK Downloader Plugin <= 1.0.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software APK Downloader Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51654 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 501bc3a355c2 Credits SOPROBRO Required...
PT-2024-29708 · Unknown · Acr.Browser.Lightning +1
Name of the Vulnerable Software and Affected Versions: com.videodownload.browser.videodownloader aka AppTool-Browser-Video All Video Downloader version 20-30.05.24 Description: The issue allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity...
CVE-2024-42041
The com.videodownload.browser.videodownloader aka AppTool-Browser-Video All Video Downloader application 20-30.05.24 for Android allows an attacker to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component...
Video Downloader 安全漏洞
Video Downloader is a video downloading application. A security vulnerability exists in Video Downloader version 20-30.05.24. An attacker can exploit this vulnerability to execute arbitrary JavaScript code via the acr.browser.lightning.DefaultBrowserActivity component...
Unmasking Lumma Stealer: Analyzing Deceptive Tactics with Fake CAPTCHA
Summary Lumma Stealer is an information-stealing malware available through a Malware-as-a-Service MaaS. It specializes in stealing sensitive data such as passwords, browser information, and cryptocurrency wallet details. The attacker has advanced its tactics, moving from traditional phishing to...
Malicious code in rs-downloader (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-9807 Malicious code in rs-downloader (npm)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in botframework-webchat-cldr-data-downloader (npm)
The package contains code to exfiltrate local machine information to a remote server over DNS. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 069cec738fcd016cead066052e66581ac130f721c6454d3079b1d054381031e8 Any computer that has this package installed or running...
MAL-2024-9217 Malicious code in botframework-webchat-cldr-data-downloader (npm)
The package contains code to exfiltrate local machine information to a remote server over DNS. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 069cec738fcd016cead066052e66581ac130f721c6454d3079b1d054381031e8 Any computer that has this package installed or running...
Mustang Panda Deploys Advanced Malware to Spy on Asia-Pacific Governments
The threat actor tracked as Mustang Panda has refined its malware arsenal to include new tools in order to facilitate data exfiltration and the deployment of next-stage payloads, according to new findings from Trend Micro. The cybersecurity firm, which is monitoring the activity cluster under the...
Malicious code in harthat-hash (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
Malicious code in harthat-api (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
Malicious code in call-blockflow (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
MAL-2024-8842 Malicious code in call-blockflow (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
MAL-2024-8844 Malicious code in harthat-hash (npm)
The package contains a preinstall hook which silently executes a malicious script with downloader functionality. This is characteristic of an ongoing North Korean state-sponsored campaign...
PEAKLIGHT Downloader Deployed in Attacks Targeting Windows with Malicious Movie Downloads
Cybersecurity researchers have uncovered a never-before-seen dropper that serves as a conduit to launch next-stage malware with the ultimate goal of infecting Windows systems with information stealers and loaders. "This memory-only dropper decrypts and executes a PowerShell-based downloader,"...