959 matches found
Malicious code in release-management-slack (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49163d92ffb97afb9729732cebbed2da537b38362599cd5d45078f08c26aed36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
PT-2023-31513 · Medusa · Medusa
Name of the Vulnerable Software and Affected Versions: Medusa versions prior to 1.0.19 Description: Medusa is an automatic video library manager for TV shows. The issue is related to unauthenticated blind server-side request forgery SSRF. The testslack request handler in...
slsa-verifier vulnerable to mproper validation of npm's publish attestations
Summary slsa-verifier attestationstampered.json 5. SLSAVERIFIEREXPERIMENTAL=1 slsa-verifier verify-npm-package supreme-goggles.tgz --attestations-path attestationstampered.json --builder-id "https://github.com/actions/runner/github-hosted" --package-name "@trishankatdatadog/supreme-goggles"...
GHSA-R2XV-VPR2-42M9 slsa-verifier vulnerable to mproper validation of npm's publish attestations
Summary slsa-verifier attestationstampered.json 5. SLSAVERIFIEREXPERIMENTAL=1 slsa-verifier verify-npm-package supreme-goggles.tgz --attestations-path attestationstampered.json --builder-id "https://github.com/actions/runner/github-hosted" --package-name "@trishankatdatadog/supreme-goggles"...
Aws-Waf-Header-Analyzer - The Purpose Of The Project Is To Create Rate Limit In AWS WaF Based On HTTP Headers
The purpose of the project is to create rate limit in AWS WaF based on HTTP headers. Golang is a dependencie to build the binary. See the documentation to install: https://go.dev/doc/install make sudo make install The rules configuration is very simple, for example, the threshold is the limited o...
GitHub's Secret Scanning Feature Now Covers AWS, Microsoft, Google, and Slack
GitHub has announced an improvement to its secret scanning feature that extends validity checks to popular services such as Amazon Web Services AWS, Microsoft, Google, and Slack. Validity checks, introduced by the Microsoft subsidiary earlier this year, alert users whether exposed tokens found by...
GHSA-FWR2-64VR-XV9M Argo CD cluster secret might leak in cluster details page
Impact Argo CD Cluster secrets might be managed declaratively using Argo CD / kubectl apply. As a result, the full secret body is stored inkubectl.kubernetes.io/last-applied-configuration annotation. https://github.com/argoproj/argo-cd/pull/7139 introduced the ability to manage cluster labels and...
Moniorg - Tool That Leverages Crt.Sh Website To Monitor Domains Of A Target
By looking through CT logs an attacker can gather a lot of information about organization's infrastructure i.e. internal domains,email addresses in a completly passive manner. moniorg leverage certificate transparency logs to monitor for newly issued domains based on organization field in their S...
Mozilla: Mozilla Mastodon Staging Instance Admin API Key Disclosure Through Slack
Admin Mastodon API keys were inadvertently disclosed in the trust-and-safety-eng channel on Mozilla's Slack workspace, potentially granting unauthorized access to the Mastodon server and compromising user data. Immediate action is required to mitigate this vulnerability...
Introducing Free Wordfence Intelligence WordPress Vulnerability Webhook Notifications!
We’re incredibly excited to announce that we have launched a webhook integration for vulnerabilities as part of Wordfence Intelligence, which enables users to stay on top of the latest vulnerabilities being added to the Wordfence Intelligence WordPress Vulnerability database, all completely for...
Internet Bug Bounty: SSRF Vulnerability through Connection test feature
A security vulnerability was found in Apache Airflow versions prior to 2.7.0. An authenticated user with Connection edit privileges could exploit this vulnerability to access connection information and perform a denial of service attack on the server. Upgrading to version 2.7.0 or newer is...
Netflix Dispatch 安全漏洞
Netflix Dispatch is a US-based Netflix company's software that provides security event management with deep integration with Slack, GSuite, Jira, etc. tools. Netflix Dispatch suffers from a security vulnerability that stems from a server response that includes the JWT key used to sign JWT tokens ...
Improper Input Validation
gitlab is vulnerable to Improper Input Validation. The vulnerability exists because the Gitlab's Slack integration is incorrectly validate the user input, which allows an attacker to send maliciously crafted URLs...
Exploit for CVE-2023-38820
DLL-Planting-Slack-4.33.73-CVE-2023-38820 DLL Planting in the...
WordPress Fullworks Slack Plugin <= 1.0.1 is vulnerable to Cross Site Scripting (XSS)
Software Fullworks Slack Type Plugin Vulnerable versions = 1.0.1 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4a8ad72a132f Credits Rafie Muhammad Patchstack Required...
HackerOne: Draft report exposure via slack alerting system for programs
Vulnerability description not provided...
Generative-AI apps & ChatGPT: Potential risks and mitigation strategies
Losing sleep over Generative-AI apps? You're not alone or wrong. According to the Astrix Security Research Group, mid size organizations already have, on average, 54 Generative-AI integrations to core systems like Slack, GitHub and Google Workspace and this number is only expected to grow. Contin...
GHSA-WM7R-3QXJ-5XGQ Duplicate Advisory: Grafana Improper Access Control vulnerability
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-cvm3-pp2j-chr3. This link is maintained to preserve external references. Original Description Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available...
Grafana 安全漏洞
Grafana is Grafana open source set of open source monitoring tools that provide a visual monitoring interface . The tool is mainly used to monitor and analyze Graphite, InfluxDB and Prometheus and so on. A security vulnerability exists in Grafana versions prior to 9.4.12, 9.5.3, and 9.5.3. The...
