MAL-2024-9379 Malicious code in mp3-do-wnload-file-to-day-46223-waltz-of-a-ghetto-fly-i2glp-eayvqc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca4db2ebb472113c9c8aed106f041fd82795a07008b23b13101e954888ffffc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8687 Malicious code in @diotoborg/vero-quaerat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c5d803035d0708d3e5097f172dcffec0e8fd9dcf7cf966310d86bc14fcc8357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8313 Malicious code in @diotoborg/eveniet-eaque-fugit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab4b67b30184871b00c2c0395f8ce53bba58ecaf6020bd3db15e12bb9d787172 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8103 Malicious code in @diotoborg/accusamus-nam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 800a2236f47e2846d9c8149c53afd493ae23544afcd9ebe2d1818044afb8247c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8699 Malicious code in @diotoborg/voluptatibus-earum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b53d9e7344ed5cc201141a38eec41a306f10e7a148383d569b57cabfbeeecf0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8537 Malicious code in @diotoborg/quae-nesciunt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 824f173c001d71ea09d9d7710add0ff3cb588f24c064118040f081dc5f3b0e08 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/dicta-recusandae-veniam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ec79f36c2a8336b9840f24bfc59847acfb4e18a7909792f533ece2397a29d3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-42062

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

CVE-2024-42062

CVE-2024-42062 (Apache CloudStack) : A permission validation flaw in CloudStack 4.10.0–4.19.1.0 lets domain-admins query all account-user API/secret keys, including those of root admins. An attacker with domain-admin access can leverage this to gain root-admin and other privileges, potentially co...

CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

The vulnerability of the CI/CD system’s registration data protection mechanism in TeamCity allows unauthorized access to closed keys by attackers.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of TeamCity in JetBrains is related to insufficient protection for registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to th...

MAL-2024-7469 Malicious code in style-logo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 432922df618bfa7812ba563401c7e9006bf63962b0394d88412b57d859bd2eec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7345 Malicious code in @zitterorg/quia-modi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84094d33d598cc50abb3dce6303b80fee8d899cb1fb12b43c15c2eb8847f8c65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7409 Malicious code in @zitterorg/voluptate-aliquam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2d6d2150694a90ba597cf02d3bdb834a44388c3cff43d4aaeabbb893a45626a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1435 Malicious code in @juiggitea/et-fugiat-dolorem-possimus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f13dd978f294e84f04073b38848ce840a3cdf529f9cc021425cbba996edc85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PYSEC-2024-267

A Local File Inclusion LFI vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file paths during the chat history upload process. An attacker c...

Medium: libreswan

Issue Overview: The Libreswan Project was notified of an issue causing libreswan to restart under some IKEv2 retransmit scenarios when a connection is configured to use PreSharedKeys authby=secret and the connection cannot find a matching configured secret. When such a connection is automatically...

New "GoFetch" Vulnerability in Apple M-Series Chips Leaks Secret Encryption Keys

A new security shortcoming discovered in Apple M-series chips could be exploited to extract secret keys used during cryptographic operations. Dubbed GoFetch, the vulnerability relates to a microarchitectural side-channel attack that takes advantage of a feature known as data memory-dependent...

MAL-2024-1062 Malicious code in unity-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7d7a62539b563d36148b212913759293a68090ffa3505239a01cd432698619c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...