MAL-2023-509 Malicious code in http-resources (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware db39987d6a5793a748c90045d86f1464d80c1542227b575b2e57e78fc95a1ee1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AMO2 doesn't add the lp balance of the CVXStaker to the withdrawable token amount

Lines of code Vulnerability details Impact The lp tokens held by CVXStaker can't be able to used or withdrew by AMO2. Although the jam is not permanent and the owner of the CVXStaker can use recoverToken function to withdraw them, it will cause the functions about removing liquidity break down in...

CVE-2023-29282

Adobe Substance 3D Painter versions 8.3.0 and earlier is affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file...

AZL-26614 CVE-2023-24539 affecting package golang for versions less than 1.20.7-1

Angle brackets are not considered dangerous characters when inserted into CSS contexts. Templates containing multiple actions separated by a '/' character can result in unexpectedly closing the CSS context and allowing for injection of unexpected HTML, if executed with untrusted input...

CVE-2023-24540

Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized during execution...

CVE-2023-29400

Templates containing actions in unquoted HTML attributes e.g. "attr=." executed with empty input can result in output with unexpected results when parsed due to HTML normalization rules. This may allow injection of arbitrary attributes into tags...

New TSA Cybersecurity Emergency Action Rule Impacts Cybersecurity and Compliance

On March 7, 2023, in the wake of President Joe Biden’s National Cybersecurity Strategy announcement, the U.S. Transportation Security Administration TSA issued a cybersecurity emergency action amendment for certain regulated airport and aircraft operators. The new Action Rule can have significant...

MAL-2023-504 Malicious code in hopelessly-devoted-bayou-devils-mc-1-by-am-myers-on-iphone-full-chapters- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 21029738b9431b9b77dbba20f828a2cd520190f7b589a87f3d8a9deff5bf0c9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-877 Malicious code in the-subtle-art-of-not-giving-a-fck-a-counterintuitive-approach-to-living-a-good-life-by-mark-manson- (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fcaa8d831b356a3827788e3863430bd598f0af94ac5867e89fdb784f7d8562cd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

U.S. Authorities Seize 13 Domains Offering Criminal DDoS-for-Hire Services

U.S. authorities have announced the seizure of 13 internet domains that offered DDoS-for-hire services to other criminal actors. The takedown is part of an ongoing international initiative dubbed Operation PowerOFF that's aimed at dismantling criminal DDoS-for-hire infrastructures worldwide. The...

kernel: spi: Fix simplification of devm_spi_register_controller

In the Linux kernel, the following vulnerability has been resolved: spi: Fix simplification of devmspiregistercontroller This reverts commit 59ebbe40fb51 "spi: simplify devmspiregistercontroller". If devmaddaction fails in devmaddactionorreset, devmspiunregister will be called, it decreases the...

MAL-2023-202 Malicious code in com.google.devtools.atsconsole.controller.proto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac391c6f367ea013279ad73de19d7f7829b286164a9c63b7914d2d9fe41310a5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-149 Malicious code in burningskyme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4ee30f3525c0cd1012da24e115e20326855b9dfe6d1f66764c4d2ddb89c9cd3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-1650

The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog...

CVE-2023-1650

The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog...

Design/Logic Flaw

The AI ChatBot WordPress plugin before 4.4.7 unserializes user input from cookies via an AJAX action available to unauthenticated users, which could allow them to perform PHP Object Injection when a suitable gadget is present on the blog...

Cross site scripting

The AI ChatBot WordPress plugin before 4.4.9 does not have authorisation and CSRF in the AJAX action responsible to update the OpenAI settings, allowing any authenticated users, such as subscriber to update them. Furthermore, due to the lack of escaping of the settings, this could also lead to...

SideCopy Using Action RAT and AllaKore RAT to infiltrate Indian Organizations

The suspected Pakistan-aligned threat actor known as SideCopy has been observed leveraging themes related to the Indian military research organization as part of an ongoing phishing campaign. This involves using a ZIP archive lure pertaining to India's Defence Research and Development Organizatio...

Malicious code in serverless-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c89475cfcb2e297c9055323646693ea6dd4a4b4f744b2802c608fdb86f04be92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-771 Malicious code in serverless-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c89475cfcb2e297c9055323646693ea6dd4a4b4f744b2802c608fdb86f04be92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...