MAL-2024-10497 Malicious code in client-req-bans (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7b540646327a4a8326c496059737e3bb81af664a3c51951c1a4caeb0e265496 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-48952

An issue was discovered in Logpoint before 7.5.0. SOAR uses a static JWT secret key to generate tokens that allow access to SOAR API endpoints without authentication. This static key vulnerability enables attackers to create custom JWT secret keys for unauthorized access to these endpoints...

MAL-2024-9343 Malicious code in avail-able-albu-m-down-load-37035-boom-chicka-boom-bk3mq-llyzsk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b2797f58177b66d9be1500b40bd7b910b50660e07b0b4b73780746fcfcf57b9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9379 Malicious code in mp3-do-wnload-file-to-day-46223-waltz-of-a-ghetto-fly-i2glp-eayvqc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ca4db2ebb472113c9c8aed106f041fd82795a07008b23b13101e954888ffffc9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8687 Malicious code in @diotoborg/vero-quaerat (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6c5d803035d0708d3e5097f172dcffec0e8fd9dcf7cf966310d86bc14fcc8357 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8103 Malicious code in @diotoborg/accusamus-nam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 800a2236f47e2846d9c8149c53afd493ae23544afcd9ebe2d1818044afb8247c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8313 Malicious code in @diotoborg/eveniet-eaque-fugit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ab4b67b30184871b00c2c0395f8ce53bba58ecaf6020bd3db15e12bb9d787172 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8699 Malicious code in @diotoborg/voluptatibus-earum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b53d9e7344ed5cc201141a38eec41a306f10e7a148383d569b57cabfbeeecf0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8537 Malicious code in @diotoborg/quae-nesciunt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 824f173c001d71ea09d9d7710add0ff3cb588f24c064118040f081dc5f3b0e08 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @diotoborg/dicta-recusandae-veniam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ec79f36c2a8336b9840f24bfc59847acfb4e18a7909792f533ece2397a29d3c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-42062

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

CVE-2024-42062

CVE-2024-42062 (Apache CloudStack) : A permission validation flaw in CloudStack 4.10.0–4.19.1.0 lets domain-admins query all account-user API/secret keys, including those of root admins. An attacker with domain-admin access can leverage this to gain root-admin and other privileges, potentially co...

CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

CVE-2024-42062 Apache CloudStack: User Key Exposure to Domain Admins

CloudStack account-users by default use username and password based authentication for API and UI access. Account-users can generate and register randomised API and secret keys and use them for the purpose of API-based automation and integrations. Due to an access permission validation issue that...

The vulnerability of the CI/CD system’s registration data protection mechanism in TeamCity allows unauthorized access to closed keys by attackers.

The vulnerability of the Continuous Integration and Deployment Application Delivery system CI/CD of TeamCity in JetBrains is related to insufficient protection for registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain unauthorized access to th...

MAL-2024-7469 Malicious code in style-logo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 432922df618bfa7812ba563401c7e9006bf63962b0394d88412b57d859bd2eec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7345 Malicious code in @zitterorg/quia-modi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 84094d33d598cc50abb3dce6303b80fee8d899cb1fb12b43c15c2eb8847f8c65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7409 Malicious code in @zitterorg/voluptate-aliquam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f2d6d2150694a90ba597cf02d3bdb834a44388c3cff43d4aaeabbb893a45626a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1435 Malicious code in @juiggitea/et-fugiat-dolorem-possimus (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f13dd978f294e84f04073b38848ce840a3cdf529f9cc021425cbba996edc85 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PYSEC-2024-267

A Local File Inclusion LFI vulnerability exists in the gaizhenbiao/chuanhuchatgpt application, specifically within the functionality for uploading chat history. The vulnerability arises due to improper input validation when handling file paths during the chat history upload process. An attacker c...