MAL-2024-1619 Malicious code in dc-test1-asdf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 04026ef40e4abce9afd70341d1bbb7d8907a917e7a6bd0fd6b7ffb15623a30c0 The OpenSSF Package Analysis project identified 'dc-test1-asdf' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in @cart-ui/core-i18n (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 89568273084fef75464b1c975014417bf122a818685035e43012bb1ff5c3ba33 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1612 Malicious code in @yoimiiya/fetchs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d75204d09806f7c69f49ddc0043e5dfb208aedd7bafbf0e49fd8c0d1252643b1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-37367

creationtimestamp| type| source ---|---|--- 2024-06-14 17:53:06+00:00| seen| https://t.me/truesecator/5858...

Exploit for Code Injection in Rejetto Http_File_Server

Rejetto HFS HTTP File Server CVE-2024-23692 Vulnerability...

Nextcloud 安全漏洞

Nextcloud is a set of open source self-hosted file synchronization and sharing communication application platform from Nextcloud, Germany. A security vulnerability exists in Nextcloud Calendar, which can be exploited by an authenticated attacker to create attachments that link to other websites v...

MAL-2024-1616 Malicious code in colors-styles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77b77addbd8ed20785c5387408e4748eea849b1a038f08b1fb90a7825fe530a8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-5909

CVE-2024-5909 affects Palo Alto Networks Cortex XDR Agent on Windows. A protection mechanism flaw lets a low-privileged local Windows user disable the Cortex XDR Agent, potentially enabling malware to perform malicious activity after disabling protection. Connected documents consistently referenc...

Cortex XDR Agent: Local Windows User Can Disable the Agent

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a low privileged local Windows user to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity. Work around: No work...

MAL-2024-1591 Malicious code in ing-feat-lu-luxtrust-stick-authentication (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1e84b6fcb318d2b4cf4fc650d67ffb94a0622eb47d6b88e8662bdb6b2dc62930 The OpenSSF Package Analysis project identified 'ing-feat-lu-luxtrust-stick-authentication' @ 200.0.1 npm as malicious. It is considered malicio...

MAL-2024-1567 Malicious code in cvsr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b1dca03039860936ed84ad166255f648867de3e96266b00da0234c232f24f16a The OpenSSF Package Analysis project identified 'cvsr' @ 2.2.1 npm as malicious. It is considered malicious because: - The package communicates...

Wordpress BuddyPress plugin <= 12.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Authenticated Subscriber+ Stored Cross-Site Scripting vulnerability discovered by wesley wcraft in WordPress Plugin Activity Reactions For Buddypress versions = 12.5.0...

WordPress Activity Reactions For Buddypress Plugin <= 12.5.0 is vulnerable to Cross Site Scripting (XSS)

Software Activity Reactions For Buddypress Type Plugin Vulnerable versions = 12.5.0 Fixed in 12.5.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-4892 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 0a3e1e0166ec Credit...

MAL-2024-1562 Malicious code in aws-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4707229414d50f1284c7a7b64169463a7c7ca779faf42df6b059947dfd1b79eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-4468 · Moodle · Moodle

Name of the Vulnerable Software and Affected Versions: Moodle CMS version 3.10 Description: The issue is related to a Cross Site Scripting vulnerability in the New Activity Handler component of the Moodle virtual learning environment. This vulnerability is due to the lack of protection of the web...

MAL-2024-1560 Malicious code in pwnkunwar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b5f9675a84c2761533cd05e6f893b3df1e793d224ed0a0cc1548432bc75273a1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1558 Malicious code in cosma-ui-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 49388262dd0b3d40b1f426a488f94937d409f2ce2053702f81a099fa8ed3b3c2 The OpenSSF Package Analysis project identified 'cosma-ui-icons' @ 9999.999.3 npm as malicious. It is considered malicious because: - The packag...

MAL-2024-1557 Malicious code in glamorous-codemods (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1a6ea39de6911785f412a5a42905522010930dec6afece74458f8b4859a0fce5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1554 Malicious code in hybrid-custody (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13a1bb06f9aa541c5e1bd154fad7fb2a739cf5cbec54e7d3cd3e50d62439520d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1550 Malicious code in vue2-webviews (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 95a66e858fcc284e27c0e0ac5e2d76de3b0f6c670ac21a185369832d45f40f5b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...