261 matches found
Malicious code in smithy-client (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a3ca6db1d2e1b3b5d4cc263af07ad3bdac1620be7e66c259231937ba10ad755c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @mckesson/fetlife-assets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5dff51f1f48b8a97a03eb5dd79bd1805a4ae0aecb1417e0dcce950ef3d3cf175 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @jerusalem/fetlife-assets (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 91ea01a2f72a0291d2f0f283034dc11654a4505a3741a3e21328c920455a42f0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Privilege escalation
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the iragent.exe component, resulting in elevated rights and persistent access to t...
Rapid7 Insight Agent 代码问题漏洞
Rapid7 Insight Agent is a lightweight software from Rapid7, Inc. The software is capable of collecting data from IT assets.A security vulnerability exists in Rapid7 Insight Agent version 3.1.2.38 and prior versions, which stems from the fact that Rapid7 Insight Agent version 3.1.2.38 and prior...
CVE-2022-23835
The Visual Voice Mail VVM application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READSMS permission, and reads an IMAP credentialing message that is by design not displayed to the victim within the AOSP SMS/MMS messaging...
CVE-2022-23835
The CVE-2022-23835 issue affects Visual Voice Mail (VVM) for Android (up to 2022-02-24). A local attacker who temporarily controls an app with the READ_SMS permission can read an IMAP credentialing message that the AOSP SMS/MMS app does not display to the user, allowing persistent access to VVM d...
CVE-2022-23835
The Visual Voice Mail VVM application through 2022-02-24 for Android allows persistent access if an attacker temporarily controls an application that has the READSMS permission, and reads an IMAP credentialing message that is by design not displayed to the victim within the AOSP SMS/MMS messaging...
Hackers Exploited 0-Day Vulnerability in Zimbra Email Platform to Spy on Users
A threat actor, likely Chinese in origin, is actively attempting to exploit a zero-day vulnerability in the Zimbra open-source email platform as part of spear-phishing campaigns that commenced in December 2021. The espionage operation — codenamed "EmailThief" — was detailed by cybersecurity compa...
New Malware Used by SolarWinds Attackers Went Undetected for Years
The threat actor behind the supply chain compromise of SolarWinds has continued to expand its malware arsenal with new tools and techniques that were deployed in attacks as early as 2019, once indicative of the elusive nature of the campaigns and the adversary's ability to maintain persistent...
CVE-2021-39866
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens...
CVE-2021-39866
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens...
CVE-2021-39866
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens...
CVE-2021-39866
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens...
UBUNTU-CVE-2021-39866
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens...
CVE-2021-39866
A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens...
CVE-2021-39866
Removed by vendor...
PT-2021-22713 · Gitlab · Gitlab
Name of the Vulnerable Software and Affected Versions: GitLab versions 13.6 and later Description: A business logic error in the project deletion process allows persistent access via project access tokens. Recommendations: For GitLab versions 13.6 and later, update to a version that includes a fi...
GitLab 安全漏洞
GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to view a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab that stems from a...
Malicious Office 365 Apps Are the Ultimate Insiders
Phishers targeting Microsoft Office 365 users increasingly are turning to specialized links that take users to their organizations own email login page. After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free...