14370 matches found
Malicious code in cdp-agentkit (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e07ec87bf0a5899c4f97a1c0fcd453df1c220cea6a7a6944d6316f40f9def44c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11189 Malicious code in pocfinalone.js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 57ba0a7f365bfa72152e4c3d1f5031f733dbc369cf392a3afdf557f70546bde3 The OpenSSF Package Analysis project identified 'pocfinalone.js' @ 1.0.4 npm as malicious. It is considered malicious because: - The package...
CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint
Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...
PYSEC-2024-256
Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get request in the checkurl method is specified as allowredirects=True, which allows a server-side reque...
CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to th...
CVE-2024-53999
MobSF suffers a Stored Cross-Site Scripting (XSS) vulnerability in the Diff or Compare functionality. The issue stems from allowing scripts in the filename parameter during file uploads, enabling a malicious actor to upload a script and trigger its execution when users invoke the diff/compare fea...
CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality
Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to th...
Anatomy of Celestial Stealer: Malware-as-a-Service Revealed
Anatomy of Celestial Stealer: Malware-as-a-Service Revealed By Niranjan Hegde, Adarsh S and Shashikala Piddannavar · December 3, 2024 Introduction During proactive hunting, Trellix Advanced Research Center found samples belonging to Celestial Stealer, a JavaScript-based infostealer which is...
CVE-2024-12015
creationtimestamp| type| source ---|---|--- 2024-12-02 13:31:36+00:00| seen| https://infosec.exchange/users/cve/statuses/113583475655174182...
MAL-2024-11179 Malicious code in tailchat-service-swagger-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acf09d7e9f52a0406ff87b349906e6278f766537755abbd90395b2179ccd36fb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11178 Malicious code in tailchat-service-openapi-generator (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 22511b2b576ee7a41e7c7f6abf4e9a9fdedded65c99367d47f3f5cda4ce875c7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11177 Malicious code in spinal-service-ticket (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware aae35c4e4ff6906cb7d4d11279ee76155e4fe161e95d96ecea1f4e61e9a67412 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in spinal-core-connectorjs_type (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3451f756dd259cb0c2c30ea5f39c2d4a80eef529d40a35beafd582ce7d01420 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11172 Malicious code in spinal-core-connectorjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f55ec90344a6042cf94a3e9a576e833a0277da7732a8322612604d186cab49b6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11171 Malicious code in readium-css (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e052a1c3b7fcfedb0cee689603d30bf043df8eebeff0146be74a4b0e218d62a0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11169 Malicious code in language-babel (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 868a15884f8fa2dcf7b6c3e4c90ba8f449da26537cb4a784fc76e22057c739f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in fluid-tooltip (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f5d371b6c8c7950311649323e234550b5c9c644c9a9e2aada8180962d6dab886 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11159 Malicious code in fetlla2-js (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 626ab8d342caf421b4ede0958a23d5fecc4a7272ca83f0a7b5a4bbf2349a845c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-11158 Malicious code in o-tabssssssle (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 48f8ca040e7ad3dd3b10535c7ffe6d9ff2f150d544aff2bcb65867468408dbb5 The OpenSSF Package Analysis project identified 'o-tabssssssle' @ 10.11.12 npm as malicious. It is considered malicious because: - The package...
