MAL-2024-8925 Malicious code in basecontext (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 05b11d319e305490690fe36a31597a9a983ce7ea769f5123feb35cf24b6ac096 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8926 Malicious code in pring-payment-demo-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3eed32902e1265a8b45d6189699734582790383eb848542f28396763e05ca31 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-47000

Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources. Versions...

CVE-2024-47000

Zitadel CVE-2024-47000 affects service accounts: deactivating a service account could still allow token requests, enabling potential unauthorized access. Affected releases include 2.54.10 through 2.62.1 (various 2.x lines); fixes are in 2.62.1, 2.61.1, 2.60.2, 2.59.3, 2.58.5, 2.57.5, 2.56.6, 2.55...

CVE-2024-47000 Service Users Deactivation not Working in Zitadel

Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources. Versions...

CVE-2024-47000 Service Users Deactivation not Working in Zitadel

Zitadel is an open source identity management platform. ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources. Versions...

ZITADEL's Service Users Deactivation not Working

Impact ZITADEL's user account deactivation mechanism did not work correctly with service accounts. Deactivated service accounts retained the ability to request tokens, which could lead to unauthorized access to applications and resources. Patches 2.x versions are fixed on = 2.62.1 2.61.x versions...

MAL-2024-8915 Malicious code in bamoe-standalone-bpmn-and-dmn-editors-classic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3f4337208b3b0a1e286af8a7334f3d815345a95eb2dadeb5c4b58fdd4b43a8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in myotherpkg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7b519cc6caba1d402e742460095c9801c108ee65646034a74817ee4eec1339ad Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8917 Malicious code in ibm-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d299d0b8d9bf7cc9c318e385566c4f1c9c972374224f38ac12d8fb90612dbdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ibm-strings (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d299d0b8d9bf7cc9c318e385566c4f1c9c972374224f38ac12d8fb90612dbdb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8902 Malicious code in kk4845.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 38684730b01368b7ae01946765e8bb76b27127d47d68019c175e498d92f577fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8907 Malicious code in trjhasd (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 503e0e46dcc93da1eb303cb9bbab8553340c3c982ec1f1f52ee4d5246afd326d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8903 Malicious code in rnjnioep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4d4b28e75016946748cc0f573ed6ef13f6ba19871339cae87de357a7ceba6e6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8894 Malicious code in stripe-testfb-v3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3cd65a10f0ebad6ff909e45ebb515898fc48e522018ebf68f4290dc40ad6d1d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ably-sales-demo-frontend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1329a9a4ad55c5ef0230b58a21648b4425bbde53212764b02bffcd44be07648f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8879 Malicious code in halifax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 58b7d4d1c1a8e8e2720f2b6394db65819f21bc67f442635e470d6fecaa349545 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8881 Malicious code in noblox.js-types (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 61f85b110e2ef99a5f7687d9a38bb17edb801829da495315d60566af54ecd9a3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in awsspeedtest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 012aacebbb501da70ce895c4dc900a4784e35649b9eacbacf304f5aff9f913a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-39925

An issue was discovered in Vaultwarden formerly BitwardenRS 1.30.3. It lacks an offboarding process for members who leave an organization. As a result, the shared organization key is not rotated when a member departs. Consequently, the departing member, whose access should be revoked, retains a...