Anveo Mobile User Enumeration / Missing Certificate Validation

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Missing Certificate Validation & User Enumeration product: Anveo Mobile App and Server vulnerable version: Mobile App: 10.0.0.359 / 2016-07-13; Server: 11.0.0.5 fixed...

What to do if your company was mentioned on Darknet?

Every year is abundant with major data leaks, biggest data breaches and hacks drawing massive media attention such as Medibank and Optus data breach, Twitter data breach, and Uber and Rockstar compromise in 2022 and in T-Mobile, MailChimp and OpenAI in 2023. But are we really conscious of the tru...

Malicious code in npm_package_babel_plugins_3_1_pragma (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3632cb4fe4754d272e86ef810873600bf47c3e8c42733de77bf10571a80fc675 The OpenSSF Package Analysis project identified 'npmpackagebabelplugins31pragma' @ 99.99.99 npm as malicious. It is considered malicious because...

MAL-2023-8686 Malicious code in rechtspraak.insolventies (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1e0d29af84c44aed4e022517fdf4ddc15b112789794ec5460c0e9acb30bd90c6 The OpenSSF Package Analysis project identified 'rechtspraak.insolventies' @ 0.9.0 npm as malicious. It is considered malicious because: - The...

MAL-2023-8687 Malicious code in rechtspraak.namenlijst (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 61558cb7df82b273048fac42068f7588594066bdc9e1aec2879d1cebaadedaea The OpenSSF Package Analysis project identified 'rechtspraak.namenlijst' @ 0.9.0 npm as malicious. It is considered malicious because: - The...

Malicious code in bynderweb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4c0e459e61d88421f9f8e8abec619108bcd6e0bb8b0e6f556a442ed551cb0fa1 The OpenSSF Package Analysis project identified 'bynderweb' @ 0.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in rechtspraak.huwelijksgoederenregister (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 0cf3169f51f3ee6c09021cf60f11a4171fed6a0655488a89f8b916c949cbd03b The OpenSSF Package Analysis project identified 'rechtspraak.huwelijksgoederenregister' @ 0.12.0 npm as malicious. It is considered malicious...

The vulnerability of the application programming interface of the interactive data analysis, visualization, and Jupyter Server document creation software allows a perpetrator to gain access to confidential information.

The vulnerability of the application programming interface of the interactive data analysis, visualization, and Jupyter Server document creation software is related to deficiencies in the error reporting mechanism. Exploiting this vulnerability can allow a malicious actor, operating remotely, to...

Exploit for Injection in Vm2_Project Vm2

CVE-2023-30547 PoC Exploit for VM2 Sandbox Escape Vulnerabili...

MAL-2023-8678 Malicious code in orchestrationdesk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d7c4b49b3a4dec106baa72132f15b7493b62457fa4f2bc0c4bf2ddfe83e58ea9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Researchers Unveil GuLoader Malware's Latest Anti-Analysis Techniques

Threat hunters have unmasked the latest tricks adopted by a malware strain called GuLoader in an effort to make analysis more challenging. "While GuLoader's core functionality hasn't changed drastically over the past few years, these constant updates in their obfuscation techniques make analyzing...

MAL-2023-8676 Malicious code in privalia-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 67798a086ab24af2e15f2344e63c54848b44d2abe2edb6adf1834f8dfae7be55 The OpenSSF Package Analysis project identified 'privalia-app' @ 3.0.1 npm as malicious. It is considered malicious because: - The package...

Malicious code in details.app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 736fc86403c03abaeee1f2b781d8a9f2e7972626546c7109631a8a0b7836a273 The OpenSSF Package Analysis project identified 'details.app' @ 1.2.4 npm as malicious. It is considered malicious because: - The package...

MAL-2023-8675 Malicious code in details.app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 736fc86403c03abaeee1f2b781d8a9f2e7972626546c7109631a8a0b7836a273 The OpenSSF Package Analysis project identified 'details.app' @ 1.2.4 npm as malicious. It is considered malicious because: - The package...

convertedAmount set to zero because of bad math arithmetic

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. The pool will be able to give an outputAmount corresponding to the rawInputAmount = 0 Proof of Concept Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant...

Fee on transfer tokens are not accounted for in any way

Lines of code Vulnerability details Impact Fee on transfer or other unique tokens are not properly accounted for. This could lead to wrong accounting within The Ocean and eventual losses for the protocol. Proof of Concept The Ocean doesn't keep track of its balances when a user is wrapping a toke...

Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in libtirpc (CVE-2018-14622 CVE-2018-14621)

Summary IBM Dynamic System Analysis DSA Preboot has addressed the following vulnerabilities in libtirpc. Vulnerability Details CVEID: CVE-2018-14622 DESCRIPTION: Libtirpc is vulnerable to a denial of service, caused by a NULL pointer dereference in the rpc-based application. By flooding the...

Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in libjpeg

Summary IBM Dynamic System Analysis DSA Preboot has addressed the following vulnerabilities in libjpeg. Vulnerability Details CVEID: CVE-2018-11813 DESCRIPTION: libjpeg is vulnerable to a denial of service, caused by a large loop in the readpixel function in rdtarga.c. By persuading a victim to...

Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerability GNU C Library (CVE-2018-11236)

Summary IBM Dynamic System Analysis DSA Preboot has addressed the following vulnerability in GNU C Library. Vulnerability Details CVEID: CVE-2018-11236 DESCRIPTION: GNU glibc is vulnerable to a stack-based buffer overflow, caused by improper bounds of checking by the pathname arguments in the...

Security Bulletin: IBM Dynamic System Analysis (DSA) Preboot is affected by vulnerabilities in procps

Summary IBM Dynamic System Analysis DSA Preboot has addressed the following vulnerabilities in procps. Vulnerability Details CVEID: CVE-2018-1126 DESCRIPTION: procps-ng procps is vulnerable to a buffer overflow, caused by improper bounds checking. By sending a specially-crafted request, a remote...