MAL-2024-970 Malicious code in discord.js-commandsv14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0552b95113f728a401629d22107eae7aa9479e0632b876f49e2558af8784f665 The OpenSSF Package Analysis project identified 'discord.js-commandsv14' @ 1.0.4 npm as malicious. It is considered malicious because: - The...

Warning: New Malware Emerges in Attacks Exploiting Ivanti VPN Vulnerabilities

Google-owned Mandiant said it identified new malware employed by a China-nexus espionage threat actor known as UNC5221 and other threat groups during post-exploitation activity targeting Ivanti Connect Secure VPN and Policy Secure devices. This includes custom web shells such as BUSHWALK,...

ASB-A-298094386

In BackgroundLaunchProcessController, there is a possible way to launch arbitrary activity from the background due to BAL Bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...

Identify and De-risk Unmanaged, Unauthorized Devices With Qualys CyberSecurity Asset Management (CSAM)

69% of organizations said they experienced at least one cyberattack resulting from an exploit of an unknown or unmanaged asset such as software, cloud-based workloads user accounts, and IoT devices. Ultimately, these attacks stem from visibility gaps in the attack surface. Bringing these assets...

ASB-A-230492947

In startNextMatchingActivity of ActivityTaskManagerService.java, there is a possible way to bypass the restrictions on starting activities from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User...

CVE-2019-8801

creationtimestamp| type| source ---|---|--- 2024-01-31 14:42:08+00:00| seen| https://t.me/ctinow/176787 2024-02-01 07:36:06+00:00| seen| https://t.me/ctinow/177340...

Italian Businesses Hit by Weaponized USBs Spreading Cryptojacking Malware

A financially motivated threat actor known as UNC4990 is leveraging weaponized USB devices as an initial infection vector to target organizations in Italy. Google-owned Mandiant said the attacks single out multiple industries, including health, transportation, construction, and logistics. "UNC499...

CVE-2023-46230

creationtimestamp| type| source ---|---|--- 2024-01-30 18:32:08+00:00| seen| https://t.me/ctinow/176156 2024-01-31 14:50:05+00:00| seen| https://t.me/truesecator/5358 2024-02-22 09:36:57+00:00| seen| https://t.me/ctinow/190562...

CVE-2023-42866

creationtimestamp| type| source ---|---|--- 2024-01-30 09:11:09+00:00| seen| https://t.me/ctinow/175766 2024-01-30 09:11:10+00:00| seen| https://t.me/ctinow/175767 2024-01-30 09:11:12+00:00| seen| https://t.me/ctinow/175768...

CVE-2019-8787

creationtimestamp| type| source ---|---|--- 2024-01-29 19:51:40+00:00| seen| https://t.me/ctinow/175499 2024-01-31 08:41:41+00:00| seen| https://t.me/ctinow/176545 2024-01-31 10:36:51+00:00| seen| https://t.me/ctinow/176631 2024-01-31 12:37:17+00:00| seen| https://t.me/ctinow/176700...

Malicious code in samsungads-publisher-portal-authorizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3bdf69166b497f7cd30a51ffff97b600796cbf77f8a34ead71e7ed700f40dfc7 The OpenSSF Package Analysis project identified 'samsungads-publisher-portal-authorizer' @ 99999.999.0 npm as malicious. It is considered...

Malicious code in npm_package_dependencies_linkify_it (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 540ac82200adeadb0c42901b9214e03c897e79ee20de2be6a87beb66e45393f6 The OpenSSF Package Analysis project identified 'npmpackagedependencieslinkifyit' @ 4.0.1 npm as malicious. It is considered malicious because: ...

MAL-2024-919 Malicious code in eslint-plugin-cas (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d34434c25cc547fc15a7c3f59fb63cd2697250ac930ac08f8ee019657417dc3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

User Activity Tracking and Log < 4.1.4 - IP Spoofing

Description This plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. 1. Add X-Forwarded-For: 11.11.11.11 to any request which will be in activity log. For example in creation of new post. 2. View the activity log and see that the...

User Activity Tracking and Log < 4.1.4 - IP Spoofing

Description This plugin retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. PoC 1. Add X-Forwarded-For: 11.11.11.11 to any request which will be in activity log. For example in creation of new post. 2. View the activity log and see that...

Malicious code in yoga-layout-bf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d9b59bfda9900fe733c84e49fb2751b2e66ecd904895deedb4b591f80be5685d The OpenSSF Package Analysis project identified 'yoga-layout-bf' @ 2.1.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-916 Malicious code in yoga-layout-bf (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d9b59bfda9900fe733c84e49fb2751b2e66ecd904895deedb4b591f80be5685d The OpenSSF Package Analysis project identified 'yoga-layout-bf' @ 2.1.0 npm as malicious. It is considered malicious because: - The package...

Microsoft Warns of Widening APT29 Espionage Attacks Targeting Global Orgs

Microsoft on Thursday said the Russian state-sponsored threat actors responsible for a cyber attack on its systems in late November 2023 have been targeting other organizations and that it's currently beginning to notify them. The development comes a day after Hewlett Packard Enterprise HPE...

Why is the cost of cyber insurance rising?

I just bought an electric car last week, so Ive been shopping for new car insurance policies that could offer me a discount for ditching gas. Were all familiar with the boring process of entering the same information 10 times over into 10 different companies websites trying to see who comes out t...

CVE-2024-23649

creationtimestamp| type| source ---|---|--- 2024-01-24 15:30:59+00:00| published-proof-of-concept| https://github.com/LemmyNet/lemmy/security/advisories/GHSA-r64r-5h43-26qv 2024-01-24 19:27:01+00:00| seen| https://t.me/ctinow/173029 2024-01-26 23:11:29+00:00| seen| https://t.me/arpsyndicate/3108...