149 matches found
MAL-2024-8011 Malicious code in postman-open-technologies-knowledge-base-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a0f1159812781f3847a9da7e6b4455cd3f3ee8bd00da0eddbe589dd52d1d56e8 The OpenSSF Package Analysis project identified 'postman-open-technologies-knowledge-base-api' @ 1.2.3 npm as malicious. It is considered...
Malicious code in postman-labs-docs (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-2886 Malicious code in postman-labs-docs (npm)
--- -= Per source details. Do not edit below this line.=-...
Porch-Pirate - The Most Comprehensive Postman Recon / OSINT Client And Framework That Facilitates The Automated Discovery And Exploitation Of API Endpoints And Secrets Committed To Workspaces, Collections, Requests, Users And Teams
Porch Pirate started as a tool to quickly uncover Postman secrets, and has slowly begun to evolve into a multi-purpose reconaissance / OSINT framework for Postman. While existing tools are great proof of concepts, they only attempt to identify very specific keywords as "secrets", and in very...
Malicious code in mastercard-postman-encryption-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 691dd44f85f523c698375261ea598d5fdee9c92da99d633a29b32bc5a2b44068 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-1084 Malicious code in mastercard-postman-encryption-lib (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 691dd44f85f523c698375261ea598d5fdee9c92da99d633a29b32bc5a2b44068 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-23738
An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor states "we dispute the report's accuracy ... the configuration does not enable remote code execution.."...
CVE-2024-23738
An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor states "we dispute the report's accuracy ... the configuration does not enable remote code execution.."...
Remote code execution
An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor states "we dispute the report's accuracy ... the configuration does not enable remote code execution.."...
Postman Security Vulnerability
Postman is an API platform for developers from the US-based Postman Inc. A security vulnerability exists in Postman prior to version 10.22, which stems from arbitrary code execution via the RunAsNode and enableNodeClilnspectArguments settings...
CVE-2024-23738
CVE-2024-23738 affects Postman versions 10.22 and earlier on macOS. The vulnerability is described as remote code execution via RunAsNode and enableNodeClilnspectArguments settings; PT-2024-1464 additionally links this to a buffer overflow when handling PDF data, though the vendor disputes that t...
CVE-2024-23738
An issue in Postman version 10.22 and before on macOS allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. NOTE: the vendor states "we dispute the report's accuracy ... the configuration does not enable remote code execution.."...
PT-2024-1464 · Postman · Postman
Name of the Vulnerable Software and Affected Versions: Postman versions 10.22 and earlier Description: The issue allows a remote attacker to execute arbitrary code via the RunAsNode and enableNodeClilnspectArguments settings. It is related to a buffer overflow when handling PDF files without...
Porch-Pirate - The Most Comprehensive Postman Recon / OSINT Client And Framework That Facilitates The Automated Discovery And Exploitation Of API Endpoints And Secrets Committed To Workspaces, Collections, Requests, Users And Teams
Porch Pirate started as a tool to quickly uncover Postman secrets, and has slowly begun to evolve into a multi-purpose reconaissance / OSINT framework for Postman. While existing tools are great proof of concepts, they only attempt to identify very specific keywords as "secrets", and in very...
Cognizant: Disclosure of the valid Cognizant credentials at the Postman collection
Vulnerability description not provided...
GHSA-VX8M-6FHW-PCCW @node-saml/node-saml's validatePostRequestAsync does not include checkTimestampsValidityError
Summary The lack of checking of current timestamp allows a LogoutRequest XML to be reused multiple times even when the current time is past the NotOnOrAfter. Details It was noticed that in the validatePostRequestAsync flow in saml.js, the current timestamp is never checked. This could present a...
Malicious code in postman-zendesk-support-theme (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e3501f72f7b7c1700a90f7ad5e3a55cd2462c210637c68dc75f9d336e9bf0063 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
InsightAppSec Advanced Authentication Settings: Token Replacement
There are many different ways to use InsightAppSec to authenticate to web apps, but sometimes you need to go deeper into the advanced settings to fully automate your logins, especially with API scanning. Today, we’ll cover one of those advanced settings: Token Replacement. InsightAppSec Token...
