Malicious code in copilot-web-widgets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fbb28669371353c111a05f7fb6bb2803179610b8ccec893590a34d2343e90fc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mp-template (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cff4fab9afd0251fc2a7551653c7605a21ecffc47bcfee194740e479aff3979 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in paypal-messages-android (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 566f2539409828163b03e79534cea7b15424dcda3b8ad2435ab9deba555757e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Powermail TYPO3 extension Broken Access Control in the OutputController

An issue was discovered in powermail extension through 12.3.5 for TYPO3. Several actions in the OutputController can directly be called, due to missing or insufficiently implemented access checks, resulting in Broken Access Control. Depending on the configuration of the Powermail Frontend plugins...

Malicious code in @digital-experience/product (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2c435487f72fee4bd3fad67cf95fb62296a2a78c8e5f4079e9e40dd35493753 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tsconfig-react-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4aff665839335434b8a93a1a8881d423eb7ff5ab92725d898e4db717468a59e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Linux Malware 'sedexp' Hides Credit Card Skimmers Using Udev Rules

Cybersecurity researchers have uncovered a new stealthy piece of Linux malware that leverages an unconventional technique to achieve persistence on infected systems and hide credit card skimmer code. The malware, attributed to a financially motivated threat actor, has been codenamed sedexp by Aon...

BIT-VALKEY-2023-28425 Specially crafted MSETNX command can lead to denial-of-service

Redis is an in-memory database that persists on disk. Starting in version 7.0.8 and prior to version 7.0.10, authenticated users can use the MSETNX command to trigger a runtime assertion and termination of the Redis server process. The problem is fixed in Redis version 7.0.10...

BIT-KEYDB-2021-32762 Integer overflow that can lead to heap overflow in redis-cli, redis-sentinel on some platforms

Redis is an open source, in-memory database that persists on disk. The redis-cli command line tool and redis-sentinel service may be vulnerable to integer overflow when parsing specially crafted large multi-bulk network replies. This is a result of a vulnerability in the underlying hiredis librar...

Cybercriminals Exploit Popular Software Searches to Spread FakeBat Malware

Cybersecurity researchers have uncovered a surge in malware infections stemming from malvertising campaigns distributing a loader called FakeBat. "These attacks are opportunistic in nature, targeting users seeking popular business software," the Mandiant Managed Defense team said in a technical...

CVE-2024-34742

In shouldWrite of OwnersData.java, there is a possible edge case that prevents MDM policies from being persisted due to a logic error in the code. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2024-26153 · Google · Android

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a logic error in the code of OwnersData.java, specifically in the shouldWrite method. This error can prevent MDM policies from...

eLabFTW 安全漏洞

eLabFTW is an open source experimental data hosting platform from eLabFTW Open Source. The platform runs on Linux and supports storing a wide range of objects. A security vulnerability exists in versions prior to eLabFTW 5.0.0 that stems from allowing administrators to create new users by default...

CVE-2024-40893

Firewalla CVE-2024-40893: Multiple authenticated OS command injection vulnerabilities in Firewalla Box Software prior to 1.979. A physically close attacker authenticated to the Bluetooth Low-Energy (BTLE) interface can abuse the network configuration service to inject commands into parameters suc...

Firewalla 安全漏洞

Firewalla is a driver from Firewalla Inc. A security vulnerability exists in Firewalla versions prior to 1.979 that stems from the presence of multiple authenticated operating system command injection vulnerabilities. An attacker authenticated with the Bluetooth Low Power Interface can use the...

People-Search Site Removal Services Largely Ineffective

Consumer Reports has a new study of people-search site removal services, concluding that they dont really work: As a whole, people-search removal services are largely ineffective. Private information about each participant on the people-search sites decreased after using the people-search removal...

Malicious code in incisive_testing_stufff (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 37f03819dee879740c46b3604769e69cdb0402e7b91eed0ae39079f3306d5bad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in babel-preset-sofi-scripts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f98a5f8b5f0da82a5cd8832e176ca57effe972fad5d0ef298183a66d9a60183 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in taap-bernie-plugin-pendo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53711d2f163bf531869a9b6c4b90c012e6cf7c59304f4fb4acc8ddfd60386fb2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in react-hook-form-7 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7657179ab2d7f76638491093d7c970bd9685b7228d96bf1014ee8ea15606c45a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...