Malicious code in normal-dep (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f2efb34b8082c086da6493f93ca16d2de070a218ff6cb8f2c32468ca268412f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11224 Malicious code in file-dep-a (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 167e76bf6af632f8aff7b06b0a8b05d6a25772b2cb139605e13b5b9a84ecf53b The OpenSSF Package Analysis project identified 'file-dep-a' @ 1.2.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-11223 Malicious code in usdc.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c87f8dca2d6eefcdbdec42cfba8e7b187195b7531d277735a9e255911fc1e3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11222 Malicious code in prettier-v3-for-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 522c1e741b8482af7e3577e20c83b8e29a0f217b9c951d0e815e5c01af165408 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11814 Malicious code in @tradm/my_package_legit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 29cce75017efa5cb89df0d22884f39b9d70b835108800ea9b64b10f295f11eb7 The OpenSSF Package Analysis project identified '@tradm/mypackagelegit' @ 1.9.24 npm as malicious. It is considered malicious because: - The...

Malicious code in asuuuuu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 40d2219a3e70e5af240f63d41ab082cad543b84acf2abd045011db292bc69654 The OpenSSF Package Analysis project identified 'asuuuuu' @ 3.1.3 npm as malicious. It is considered malicious because: - The package communicat...

MAL-2024-11219 Malicious code in asuuuuu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 40d2219a3e70e5af240f63d41ab082cad543b84acf2abd045011db292bc69654 The OpenSSF Package Analysis project identified 'asuuuuu' @ 3.1.3 npm as malicious. It is considered malicious because: - The package communicat...

IBM Cloud Pak for Data Resource Management Error Vulnerability

IBM Cloud Pak for Data is a cloud-native solution from International Business Machines IBM that allows customers to use data and analyze it quickly and efficiently. A resource management error vulnerability exists in IBM Cloud Pak for Data versions 4.0.0 through 5.0.2, which stems from not proper...

MAL-2024-11249 Malicious code in privy-frames-drop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d7f03babad9cbb72b88a3dac7beadb5275fa4c3ab5364d435f372bf5dffbd8ee The OpenSSF Package Analysis project identified 'privy-frames-drop' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in privy-frames-drop (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d7f03babad9cbb72b88a3dac7beadb5275fa4c3ab5364d435f372bf5dffbd8ee The OpenSSF Package Analysis project identified 'privy-frames-drop' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Our secret ingredient for reverse engineering

Nowadays, a lot of cybersecurity professionals use IDA Pro as their primary tool for reverse engineering. While IDA is a complex tool that implements a multitude of features useful for dissecting binaries, many reverse engineers use various plugins to add further functionality to this software. W...

Planet Technology Planet WGS-804HPT

RISK EVALUATION Successful exploitation of these vulnerabilities could result in remote code execution. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as: Minimize network exposure for all control system...

Malicious code in private-lib-bug-bounty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef8c8e73b8b4d3414d06cadfd08f308a41276fe31204d26bc85d1eb566c4923c The OpenSSF Package Analysis project identified 'private-lib-bug-bounty' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2024-11188 Malicious code in private-lib-bug-bounty (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis ef8c8e73b8b4d3414d06cadfd08f308a41276fe31204d26bc85d1eb566c4923c The OpenSSF Package Analysis project identified 'private-lib-bug-bounty' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Malicious code in cdp-agentkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e07ec87bf0a5899c4f97a1c0fcd453df1c220cea6a7a6944d6316f40f9def44c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11189 Malicious code in pocfinalone.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 57ba0a7f365bfa72152e4c3d1f5031f733dbc369cf392a3afdf557f70546bde3 The OpenSSF Package Analysis project identified 'pocfinalone.js' @ 1.0.4 npm as malicious. It is considered malicious because: - The package...

CVE-2024-54002 Dependency-Track allows enumeration of managed users via /api/v1/user/login endpoint

Dependency-Track is a Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Performing a login request against the /api/v1/user/login endpoint with a username that exist in the system takes significantly longer than performing the same...

PYSEC-2024-256

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. In versions prior to 3.9.7, the requests.get request in the checkurl method is specified as allowredirects=True, which allows a server-side reque...

CVE-2024-53999 Mobile Security Framework (MobSF) Stored Cross-Site Scripting Vulnerability in "Diff or Compare" Functionality

Mobile Security Framework MobSF is a pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis. The application allows users to upload files with scripts in the filename parameter. As a result, a malicious user can upload a script file to th...

CVE-2024-53999

MobSF suffers a Stored Cross-Site Scripting (XSS) vulnerability in the Diff or Compare functionality. The issue stems from allowing scripts in the filename parameter during file uploads, enabling a malicious actor to upload a script and trigger its execution when users invoke the diff/compare fea...