14416 matches found
GHSA-4VRV-93C7-M92J snyk Code Injection vulnerability
The package snyk before 1.1064.0 is vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application...
Open-Source Projects Use the Wordfence Vulnerability Data Feed API and You Can Too!
Prior to joining the Wordfence Threat Intelligence team, I spent several years as a vulnerability analyst, responsible for collecting, analyzing, and curating every publicly disclosed vulnerability. This meant collecting vulnerability information from almost a hundred different, disparate sources...
Security Bulletin: Denial of Service Vulnerability in Apache Solr used by IBM Operations Analytics - Log Analysis
Summary There is a potential denial of service in Apache Solr that is used by IBM Operations Analytics - Log Analysis Vulnerability Details IBM X-Force ID: 216835 DESCRIPTION: Apache Lucene is vulnerable to a denial of service. By sending a specific regular expression query, a remote attacker cou...
1Panel vulnerable to command injection when adding container repositories
Impact The authenticated attacker can craft a malicious payload to achieve command injection when adding container repositories. 1. Vulnerability analysis. backend\app\api\v1\imagerepo.gocreate backend\app\service\imagerepo.goCheckConn 2. vulnerability reproduction. POST /api/v1/containers/repo...
ScrapPY - A Python Utility For Scraping Manuals, Documents, And Other Sensitive PDFs To Generate Wordlists That Can Be Utilized By Offensive Security Tools
ScrapPY is a Python utility for scraping manuals, documents, and other sensitive PDFs to generate targeted wordlists that can be utilized by offensive security tools to perform brute force, forced browsing, and dictionary attacks. ScrapPY performs word frequency, entropy, and metadata analysis, a...
Malicious code in react-green-ui (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 3109c997fe1ab2888814f3679bf903a97bce7112d5921a921ae0aea7d787fe3d The OpenSSF Package Analysis project identified 'react-green-ui' @ 10.0.49 npm as malicious. It is considered malicious because: - The package...
Evasive Meduza Stealer Targets 19 Password Managers and 76 Crypto Wallets
In yet another sign of a lucrative crimeware-as-a-service CaaS ecosystem, cybersecurity researchers have discovered a new Windows-based information stealer called Meduza Stealer that's actively being developed by its author to evade detection by software solutions. "The Meduza Stealer has a...
MAL-2023-1321 Malicious code in thentiacloud-angularjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 080925c1a04cb601b6c5a204f7e8db92592ee52721272a7effa1eb5caf5207c8 The OpenSSF Package Analysis project identified 'thentiacloud-angularjs' @ 1.2.0 npm as malicious. It is considered malicious because: - The...
Malicious code in thentiacloud-angularjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 080925c1a04cb601b6c5a204f7e8db92592ee52721272a7effa1eb5caf5207c8 The OpenSSF Package Analysis project identified 'thentiacloud-angularjs' @ 1.2.0 npm as malicious. It is considered malicious because: - The...
MAL-2023-1220 Malicious code in js-starter-code (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac64c737affe45fd76d9899026d4a4d2f775e04e0391693ffcb2dafa665b07c5 The OpenSSF Package Analysis project identified 'js-starter-code' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...
Malicious code in js-starter-code (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ac64c737affe45fd76d9899026d4a4d2f775e04e0391693ffcb2dafa665b07c5 The OpenSSF Package Analysis project identified 'js-starter-code' @ 1.1.1 npm as malicious. It is considered malicious because: - The package...
New technique can defeat voice authentication "after only six tries"
Voice authentication is back in the news with another tale of how easy it might be to compromise. University of Waterloo scientists have discovered a technique which they claim can bypass voice authentication with "up to a 99% success rate after only six tries". In fact this method is apparently ...
CVE-2023-28387
"NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a local attacker to analyze data in the app and to obtain API key for an external service...
CVE-2023-28387
The CVE-2023-28387 entry concerns the NewsPicks mobile apps for Android (versions 10.4.5 and earlier) and iOS (versions 10.4.2 and earlier) that hard‑code credentials, enabling a local attacker to access app data and potentially obtain an API key for an external service. Affected components are t...
CVE-2023-28387
"NewsPicks" App for Android versions 10.4.5 and earlier and "NewsPicks" App for iOS versions 10.4.2 and earlier use hard-coded credentials, which may allow a local attacker to analyze data in the app and to obtain API key for an external service...
MAL-2023-1288 Malicious code in schweppes (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c6413b14065c0dae4dd031864f7a515ead037541f7f74a2907a2d554ebe4e7fe The OpenSSF Package Analysis project identified 'schweppes' @ 1.0.2 npm as malicious. It is considered malicious because: - The package...
MISP 安全漏洞
MISP is an open source software solution. The product is used to collect, store, distribute, and share cybersecurity metrics and has features such as threat cybersecurity event analysis and malware analysis. A security vulnerability exists in MISP version 2.4.172, which stems from the incorrect...
Malicious code in jquery-overscroll (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 279b9014e86c11c82ac819b5e3bbbbbfc2868e3131b65bd941e60d08985cfbb0 The OpenSSF Package Analysis project identified 'jquery-overscroll' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2023-1219 Malicious code in jquery-overscroll (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 279b9014e86c11c82ac819b5e3bbbbbfc2868e3131b65bd941e60d08985cfbb0 The OpenSSF Package Analysis project identified 'jquery-overscroll' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
