Rogue PyPI Library Solana Users, Steals Blockchain Wallet Keys

Cybersecurity researchers have discovered a new malicious package on the Python Package Index PyPI repository that masquerades as a library from the Solana blockchain platform but is actually designed to steal victims' secrets. "The legitimate Solana Python API project is known as 'solana-py' on...

PT-2024-7210 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 8.16 through 17.2.9 GitLab CE/EE versions 17.3 through 17.3.5 GitLab CE/EE versions 17.4 through 17.4.2 Description: An issue was discovered in GitLab CE/EE, which allows deploy keys to push to an archived repository. Th...

How Hackers Extracted the ‘Keys to the Kingdom’ to Clone HID Keycards

A team of researchers have developed a method for extracting authentication keys out of HID encoders, which could allow hackers to clone the types of keycards used to secure offices and other areas worldwide...

MAL-2024-8012 Malicious code in @avaldigitallabs/adl-pfm-lib-web-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95ed6f4ad493c3bd3069194fa08ab5dd589b970ecc22219f0b5bf9162b0ecfa9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-39287

Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys...

CVE-2024-39287 Dorsett Controls InfoScan Exposure of Sensitive Information To An Unauthorized Actor

Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys...

CVE-2024-39287

CVE-2024-39287 affects Dorsett Controls InfoScan ecosystem (notably the Central Server update server). The vulnerability is due to an information leak from an unprotected file that contains passwords and API keys, enabling potential exposure. Connected advisories corroborate the issue and note as...

CVE-2024-39287 Dorsett Controls InfoScan Exposure of Sensitive Information To An Unauthorized Actor

Dorsett Controls Central Server update server has potential information leaks with an unprotected file that contains passwords and API keys...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to security bypass due to xml2js ( CVE-2023-0842 )

Summary xml2js is used by IBM Cloud Pak for Data as part of the platform. CVE-2023-0842. Vulnerability Details CVEID:CVE-2023-0842 DESCRIPTION: xml2js could allow a remote attacker to bypass security restrictions, caused by the failure to properly validate incoming JSON keys, allowing the proto...

Security Bulletin: IBM Cloud Pak for Data is vulnerable to resource exhaustion attack due to github.com/Cloudflare/cfssl ( CVE-2023-39533 )

Summary github.com/Cloudflare/cfssl is used by IBM Cloud Pak for Data. CVE-2023-39533. Vulnerability Details CVEID:CVE-2023-39533 DESCRIPTION: libp2p go-libp2p is vulnerable to a denial of service, caused by a flaw during the signature verification. By sending a specially crafted request using...

Open WebUI 0.1.105 File Upload / Path Traversal Vulnerabilities

Title: Open WebUI Arbitrary File Upload + Path Traversal Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-006.txt 1. Vulnerability Details Affected Vendor: Open WebUI Affected Product: Open WebUI Affected Version: 0.1.105 Platform: Debian 12 CWE Classification: CWE-22:...

Dorsett Controls InfoScan 信息泄露漏洞

Dorsett Controls InfoScan is an industrial information scanner from Dorsett Controls, USA. An information disclosure vulnerability exists in Dorsett Controls InfoScan versions 1.32, 1.33, and 1.35, which originates from an unprotected file containing passwords and API keys, resulting in an...

MAL-2024-7965 Malicious code in iva-react-web-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 94e079d8c7b731da869ff846e164d4a9c87faed0108d764e4048bde129a25f17 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7946 Malicious code in desttest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7ce29abf82517f489205831e3afc5da12a742b761b3de9abfa53ab3d4b14b67b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7942 Malicious code in click-action-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 863f4bd9c81749474f2360ad027e111369d13c2c699078f5ae2311e627b0d2fa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7976 Malicious code in new-relic-browser (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b484734422b24dacf15c15aabdc6a98a5b34da6281c42feab2eea60be6bd36f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7930 Malicious code in babel-preset-sofi-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f98a5f8b5f0da82a5cd8832e176ca57effe972fad5d0ef298183a66d9a60183 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7999 Malicious code in uitk-react-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea103fb47eaf7b83ad10f5bbba8f4806de1cf066e8fce87deef49cdb0526a7bd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7927 Malicious code in ampersend-mymove (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 68f91f3919727e3175e15cbeaa1078a642bb1ed31368c7a8e6cb29c88af407cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7958 Malicious code in frontend-static-props-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bb3f52abf232df0db4fc9cbe55d6234cff445cff215bbeb3e5a26a4f26b843a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...