MAL-2022-192 Malicious code in @cybernated/core-ui-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 583d74dfe9c810d3ddd6e71a070b7a29cea19002f5505e8cf0406110d7fc67cc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5600 Malicious code in rbflugplan (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acf18eb978601390777f8b916c22add38d0e4b259187cf19959b4b05495a91f7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-795 Malicious code in @zivver/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 252563d49ca0b12c7e64af6a853395f0e071b90cb7e08479fccac1ff8ad07983 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-209 Malicious code in @dropbox/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4b81c53309606cb531509675ff55dd3d9c2b9cd5518165c5de27bd89989205c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-554 Malicious code in @ramp106/timetable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f0c1f1936340296dbd7b47d801de1c46eb27852baea723e6522aac030479a2c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

LinkedIn scams are a “significant threat”, warns FBI

Digital currency fraud is a growing issue on social media, and LinkedIn is no different. In fact, according to according to Sean Ragan, the FBI’s special agent in charge of the San Francisco and Sacramento, California, field offices, cryptocurrency scams are big business on LinkedIn. "It’s a...

Malicious code in assign-issue (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53a2b09ab1126c4a4ebd76c0f8518d07c61a25eafcba6c73e5eae4302121bdaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3857 Malicious code in integration-framework (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eab96423a267bad86afc0855732ba4c4d79dd8a3532d34337c43268c57dcadd9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

BlackCat Ransomware Gang Targeting Unpatched Microsoft Exchange Servers

Microsoft is warning that the BlackCat ransomware crew is leveraging exploits for unpatched Exchange server vulnerabilities to gain access to targeted networks. Upon gaining an entry point, the attackers swiftly moved to gather information about the compromised machines, followed by carrying out...

Malicious code in sp-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12ea0ed6eb9e952555479abaffce89b9ec1fabf26dab71f7e5fff8cf1b0ed57a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GHSA-CHJ3-F7XW-367M OS Command Injection in git-promise

All versions of package git-promise is vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. Credits @lirantal for discoveri...

OS Command Injection in git-promise

All versions of package git-promise is vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue. Credits @lirantal for discoveri...

CVE-2022-24376

All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue...

Command injection

All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue...

CVE-2022-24376

All versions of package git-promise are vulnerable to Command Injection due to an inappropriate fix of a prior vulnerability in this package. Note: Please note that the vulnerability will not be fixed. The README file was updated with a warning regarding this issue...

PT-2022-16654 · Unknown · Git-Promise

Name of the Vulnerable Software and Affected Versions: git-promise versions all Description: The issue is related to Command Injection due to an inappropriate fix of a prior vulnerability in the git-promise package. The README file was updated with a warning regarding this issue. It is noted that...

This Week in Spring - June 7th, 2022

Hi, Spring fans! Welcome to another installment of This Week in Spring! Ive just landed in tantalizing Toronto, Canada, for the SpringOne Tour Toronto show. Im so excited to be here, at long last, after so long away from one of my favorite countries. Ill be doing two talks - my usual, Kubernetes...

Samsung mobile 安全漏洞

Samsung mobile is a cell phone from the South Korean company Samsung. A security vulnerability exists in Samsung mobile DofViewer SMR prior to Jun-2022 Release 1. An attacker can exploit the vulnerability to control the system warning window...

Login timing attack in ibexa/core

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...

GHSA-2X4V-G8CX-JXRQ Login timing attack in ibexa/core

Ibexa DXP is using random execution time to hinder timing attacks against user accounts, a method of discovering whether a given account exists in a system without knowing its password, thus affecting privacy. This implementation was found to not be good enough in some situations. The fix replace...