962 matches found
MAL-2025-45 Malicious code in solana-login (npm)
The package contains several malicious PowerShell and VBS scripts used to harvest browser data, take screenshots, log keystrokes, and establish startup persistence. It also bundles a password stealer and exfiltrates stolen data via Slack and Discord webhooks. --- -= Per source details. Do not edi...
MAL-2024-12040 Malicious code in slack-sns (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dde2984debaba750af691ea1ba70116984fba098ecf0fe26a0fdf576d386f53a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in slack-sns (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dde2984debaba750af691ea1ba70116984fba098ecf0fe26a0fdf576d386f53a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2024-54682 Zipbomb DoS via Missing Slack Import Validation
Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin...
CVE-2024-54682 Zipbomb DoS via Missing Slack Import Validation
Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin...
CVE-2024-54682 Zipbomb DoS via Missing Slack Import Validation
Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin...
CVE-2024-54682
Summary (CVE-2024-54682): Mattermost Server versions 9.5.x <= 9.5.12, 9.11.x <= 9.11.4, 10.0.x <= 10.0.2, and 10.1.x
Mattermost 安全漏洞
Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a denial of service vulnerability that stems from a failure to limit the file size of slack import file uploads. An attacker could exploit this vulnerability to import data to...
Halo Security Launches Slack Integration for Real-Time Alerts on New Assets and Vulnerabilities
MIAMI, Florida, 21st November 2024, CyberNewsWire...
Secrets Exposed: Why Your CISO Should Worry About Slack
In the digital realm, secrets API keys, private keys, username and password combos, etc. are the keys to the kingdom. But what if those keys were accidentally left out in the open in the very tools we use to collaborate every day? A Single Secret Can Wreak Havoc Imagine this: It's a typical Tuesd...
Unpacking Slack Hacks: 6 Ways to Protect Sensitive Data with Secure Collaboration
Nowadays, sensitive and critical data is traveling in everyday business channels that offer only the basic level of security and encryption, and companies are often oblivious to the risk. A case in point: Disney suffered a devastating data leak by a hacktivist group known as NullBulge that got ho...
Fraudulent Slack ad shows malvertiser’s patience and skills
In the past year alone, we have reported almost five hundred unique malvertising incidents related to Google search ads. While it can be difficult to attribute each incident to a specific threat actor, we usually notice similarities between campaigns. Some malvertisers go to great lengths to bypa...
Policy bypass for Host Firewall policy due to race condition in Cilium agent
Impact A race condition in the Cilium agent can cause the agent to ignore labels that should be applied to a node. This could in turn cause CiliumClusterwideNetworkPolicies intended for nodes with the ignored label to not apply, leading to policy bypass. Patches This issue was fixed in...
Netflix Dispatch 安全漏洞
Netflix Dispatch is a US-based Netflix software that provides deep integration with Slack, GSuite, Jira and other tools and provides security event management. Netflix Dispatch suffers from a security vulnerability that stems from allowing code to be executed within blocks that have not been...
Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint
Summary This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory OOM kill. The issue...
Hackers Claim to Have Leaked 1.1 TB of Disney Slack Messages
A hacker group called “NullBulge” says it stole more than a terabyte of Disney’s internal Slack messages and files from nearly 10,000 channels in an apparent protest over AI-generated art...
Disney’s Internal Slack Breached? NullBulge Leaks 1.1 TiB of Data
Hacktivist group NullBulge claims to have breached Disney, leaking 1.1 TiB of internal Slack data. The leak allegedly…...
MAL-2024-6555 Malicious code in alerty_plugin-slack (RubyGems)
--- -= Per source details. Do not edit below this line.=-...