MAL-2025-2716 Malicious code in vistar-ad-clienttestadv3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 998a79c7a6246c56acd40382f70e1cfab273a5002ff94a5242bb0bb12b8dc962 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

⚡ THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More

A quiet tweak in a popular open-source tool opened the door to a supply chain breach—what started as a targeted attack quickly spiraled, exposing secrets across countless projects. That wasn't the only stealth move. A new all-in-one malware is silently stealing passwords, crypto, and control—whil...

What Google Chrome knows about you, with Carey Parker (Lock and Code S06E06)

This week on the Lock and Code podcast … Google Chrome is, by far, the most popular web browser in the world. According to several metrics, Chrome accounts for anywhere between 52% and 66% of the current global market share for web browser use. At that higher estimate, that means that, if the 5.5...

Scammers Sneak 300+ Ad Fraud Apps onto Google Play with 60M Downloads

Google Play Store hit by 300+ fake Android apps, downloaded more than 60 million times pushing ad fraud and data theft. Learn how to spot and remove these threats...

New Ad Fraud Campaign Exploits 331 Apps with 60M+ Downloads for Phishing and Intrusive Ads

Cybersecurity researchers have warned about a large-scale ad fraud campaign that has leveraged hundreds of malicious apps published on the Google Play Store to serve full-screen ads and conduct phishing attacks. "The apps display out-of-context ads and even try to persuade victims to give away...

BADBOX 2.0 Botnet Infects 1 Million Android Devices for Ad Fraud and Proxy Abuse

At least four different threat actors have been identified as involved in an updated version of a massive ad fraud and residential proxy scheme called BADBOX, painting a picture of an interconnected cybercrime ecosystem. This includes SalesTracker Group, MoYu Group, Lemon Group, and LongTV,...

ad-nautic.es Cross Site Scripting vulnerability OBB-4036638

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2024-51319

A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimgupload.jsp...

CVE-2024-51320

Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdmfsavehtmltmp, /servlet/gsdmbtlkopenfile components...

CVE-2024-51321

In Zucchetti Ad Hoc Infinity 2.4, an improper check on the mcURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication...

WordPress Ad Inserter plugin <= 2.8.0 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by Andres Roldan in WordPress Plugin Ad Inserter versions = 2.8.0...

CVE-2024-51321

In Zucchetti Ad Hoc Infinity 2.4, an improper check on the mcURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication...

CVE-2024-51319

A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimgupload.jsp...

CVE-2024-51321

In Zucchetti Ad Hoc Infinity 2.4, an improper check on the mcURL parameter allows an attacker to redirect the victim to an attacker-controlled website after the authentication...

CVE-2024-51322

Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /jsp/gsfrfeditorHTML.jsp, /servlet/SPVisualZoom, /jsp/gsmdcontainer.jsp components...

CVE-2024-51319

A local file include vulnerability in the /servlet/Report of Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution by uploading a jsp web/reverse shell through /jsp/zimgupload.jsp...

CVE-2024-51320

Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdmfsavehtmltmp, /servlet/gsdmbtlkopenfile components...

CVE-2024-51322

Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /jsp/home.jsp, /jsp/gsfrfeditorHTML.jsp, /servlet/SPVisualZoom, /jsp/gsmdcontainer.jsp components...

CVE-2024-51320

Cross Site Scripting vulnerability in Zucchetti Ad Hoc Infinity 2.4 allows an authenticated attacker to achieve Remote Code Execution via the /servlet/gsdmfsavehtmltmp, /servlet/gsdmbtlkopenfile components...

Zucchetti Ad Hoc Infinity 跨站脚本漏洞

Zucchetti Ad Hoc Infinity is an ERP software from Zucchetti. A cross-site scripting vulnerability exists in Zucchetti Ad Hoc Infinity version 2.4, which originates from cross-site scripting in the /servlet/gsdmfsavehtmltmp and /servlet/gsdmbtlkopenfile components and could lead to remote code...