MAL-2023-740 Malicious code in reat-com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb8a3d57163b34785a2092a45dcf9e0e1601b827c144a5a955212214317de9c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-0443

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked...

CVE-2023-0443

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked...

CVE-2023-0443

The CVE-2023-0443 entry concerns the AnyWhere Elementor WordPress plugin before version 1.2.8 which disclosed a Freemius Secret Key. According to sources (NVD/Red Hat/Patchstack/Wordfence), this key could be misused to purchase the Pro subscription using test credit card numbers without payment; ...

CVE-2023-0443 AnyWhere Elementor < 1.2.8 - Freemius API Key Disclosure

The AnyWhere Elementor WordPress plugin before 1.2.8 discloses a Freemius Secret Key which could be used by an attacker to purchase the pro subscription using test credit card numbers without actually paying the amount. Such key has been revoked...

This Week in Spring - May 30th, 2023

Hi, Spring fans! Welcome to another installment of This Week in Spring! This installment I write on the day of my daughter's High School graduation, an auspicious day indeed! There's a lot to get through this week, though, and I have a graduation to get to, so let's dive right in! Spring...

PT-2023-16274 · WordPress · Anywhere Elementor

Name of the Vulnerable Software and Affected Versions: AnyWhere Elementor WordPress plugin versions prior to 1.2.8 Description: The issue allows an attacker to obtain a Freemius Secret Key, which could be used to purchase the pro subscription using test credit card numbers without actually paying...

MAL-2023-852 Malicious code in test-solhint (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74f99bcc146fbc73b564ba66c89ede653820b218835cf0da12bbadf2c2c6408b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @brand_apps/easystart (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c717d46d6be03f627a5dd22496e0e0f20d6c159f0bf51e222789857061b0397 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-819 Malicious code in superagt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d417dfcd3054c03947066c9d5097e7bf561e9b05b055fd5e3caeea7275f4019f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-603 Malicious code in mintel-tokens (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 13b8e3e53b1d2298f3798c2348d1caa9ccbbf59e520e7f67897fe51f6d9591ba Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

The vulnerability of the Apache Superset data visualization software lies in its insecure resource initialization, which allows attackers to bypass established access controls.

The vulnerability of the Apache Superset data visualization software is related to the insecure initialization of resources. Exploiting this vulnerability can allow an attacker, operating remotely, to bypass established access controls, provided that the SECRETKEY is set by default...

MAL-2023-203 Malicious code in compute-starter-kit-assemblyscript-default (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d22fdf2ac6654a503fea802f494a8beb6fecb1b7b953919da1d01cd04e133958 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in google-bard724 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47d49aca642fc265e31226e596698a7acb317389a5c919dd055d972987d40090 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2021-25748

A security issue was discovered in ingress-nginx where a user that can create or update ingress objects can use a newline character to bypass the sanitization of the spec.rules.http.paths.path field of an Ingress object in the networking.k8s.io or extensions API group to obtain the credentials of...

GO-2023-1765 Leaked shared secret and weak blinding in github.com/cloudflare/circl

When sampling randomness for a shared secret, the implementation of Kyber and FrodoKEM, did not check whether crypto/rand.Read returns an error. In rare deployment cases error thrown by the Read function, this could lead to a predictable shared secret. The tkn20 and blindrsa components did not...

Timing Attack

github.com/ginuerzh/gost is vulnerable to Timing Attacks. The vulnerability exists because the Authenticate function of auth.go does not properly compare sensitive secrets such as passwords, tokens and API keys using constant-time comparison, which allows an attacker to guess a secret by observin...

Malicious code in ee-cloud-functions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81e2426558f083dcdd4aade89e23d39e99ff609b2ec96c53490a9cd4927f98d6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Moxa MXsecurity Series Hardcoded JWT Key Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of Moxa MXsecurity Series appliances. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the web-based interface. The issue results from a...

Malicious code in wcc-connector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e55bf83a3393a668485fec2cbcb072ee078657ab4b98b80e3debd7ec3fb83057 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...