10242 matches found
MAL-2024-1065 Malicious code in accessibletrap (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8474de211a93f6609827bb3a4e63a05cba1f2124131efd6a9ddf34edb2f89ed3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in ycs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8fcf222dfcf6f0f36588b0c11a3e0fd28bac1b86cccc3eac8afb5f9243afffb7 The OpenSSF Package Analysis project identified 'ycs' @ 3.9.9 npm as malicious. It is considered malicious because: - The package communicates...
Update now! JetBrains TeamCity vulnerability abused at scale
JetBrains issued a warning on March 4, 2024 about two serious vulnerabilities in TeamCity server. The flaws can be used by a remote, unauthenticated attacker with HTTPS access to a TeamCity on-premises server to bypass authentication checks and gain administrative control of the TeamCity server...
Fedora: Security Advisory for plantuml (FEDORA-2024-129d8ca6fc)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
[SECURITY] Fedora 40 Update: plantuml-1.2024.3-3.fc40
PlantUML is a program allowing to draw UML diagrams, using a simple and human readable text description. It is extremely useful for code documenting, sketching project architecture during team conversations and so on. PlantUML supports the following diagram types - sequence diagram - use case...
MAL-2024-1058 Malicious code in jaas-jwt (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9e138921f13c1e6284e20c35908236f156dedf323860b924ccdfda713eb03b8a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Human vs. Non-Human Identity in SaaS
In today's rapidly evolving SaaS environment, the focus is on human users. This is one of the most compromised areas in SaaS security management and requires strict governance of user roles and permissions, monitoring of privileged users, their level of activity dormant, active, hyperactive, thei...
MAL-2024-1057 Malicious code in pcln-event-dispatcher (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 58d0757d5f390b101d520dbcfa438dc8fdf9197eccea3aae851f57a1cb09eeb3 The OpenSSF Package Analysis project identified 'pcln-event-dispatcher' @ 999999999.99.9 npm as malicious. It is considered malicious because: -...
CVE-2023-49988
creationtimestamp| type| source ---|---|--- 2024-03-07 02:26:54+00:00| seen| https://t.me/ctinow/201994 2024-03-07 02:27:11+00:00| seen| https://t.me/ctinow/202006...
CVE-2024-28111 CSV Injection in exported history CSV files
Canarytokens helps track activity and actions on a network. Canarytokens.org supports exporting the history of a Canarytoken's incidents in CSV format. The generation of these CSV files is vulnerable to a CSV Injection vulnerability. This flaw can be used by an attacker who discovers an HTTP-base...
CVE-2024-20338
creationtimestamp| type| source ---|---|--- 2024-03-06 18:26:42+00:00| seen| https://t.me/ctinow/201617 2024-03-08 01:22:05+00:00| seen| https://t.me/arpsyndicate/4135...
CVE-2023-42776
creationtimestamp| type| source ---|---|--- 2024-03-06 14:41:31+00:00| seen| https://t.me/ctinow/201402...
MAL-2024-1055 Malicious code in add-sugar (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8c35253404a0c432c7a012459997f522c42254fc055677eab50061c9f4b39edc The OpenSSF Package Analysis project identified 'add-sugar' @ 1.0.10 npm as malicious. It is considered malicious because: - The package...
BIT-GITLAB-2020-13315
A vulnerability was discovered in GitLab versions before 13.1.10, 13.2.8 and 13.3.4. The profile activity page was not restricting the amount of results one could request, potentially resulting in a denial of service...
BIT-GITLAB-2020-13324
A vulnerability was discovered in GitLab versions prior to 13.1. Under certain conditions the private activity of a user could be exposed via the API...
BIT-DISCOURSE-2022-24782 Secure category names leaked via user activity export in Discourse
Discourse is an open source discussion platform. Versions 2.8.2 and prior in the stable branch, 2.9.0.beta3 and prior in the beta branch, and 2.9.0.beta3 and prior in the tests-passed branch are vulnerable to a data leak. Users can request an export of their own activity. Sometimes, due to catego...
BIT-MOODLE-2022-0332
A flaw was found in Moodle in versions 3.11 to 3.11.4. An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data...
BIT-REDMINE-2021-42326
Redmine before 4.1.5 and 4.2.x before 4.2.3 may disclose the names of users on activity views due to an insufficient access filter...
BIT-MOODLE-2023-5539 Moodle: authenticated remote code execution risk in lesson
A remote code execution risk was identified in the Lesson activity. By default this was only available to teachers and managers...