MAL-2022-71 Malicious code in @amazonvrp/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c49db6db27f75218196c60f3c92e86127175562468dc3f8e3fcee33273caaba3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @airvpn/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5075e06202a4b4316f61b5db5c991939f9ab74dc0ece41c3b6b67c8986963ac6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @8x8/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fc5d4ca5e9ccd3f061be92ad29e866ad5fb064bdede70d2d38d75bc13f978673 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @abbvie/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1300f7d59a5420ea97c0b67fddae9290508b5f2236509328ba9e987c12f97867 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-57 Malicious code in @abbvie/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1300f7d59a5420ea97c0b67fddae9290508b5f2236509328ba9e987c12f97867 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @13tv/fetlife-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c3e9b13a70405b363acb63496b08374c3bdc9747c8008a0a832d65e3d76e42ec Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in epam-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fde824f3d16819175b7781da6c196f7ad067667235e2c8663a656a8debecb58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2762 Malicious code in epam-assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5fde824f3d16819175b7781da6c196f7ad067667235e2c8663a656a8debecb58 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

_harvest() vulnerable to sandwich attacks due to missing slippage checks

Lines of code Vulnerability details Impact All funds that should have been harvested can be taken via MEV sandwich attacks because there is no slippage control. Proof of Concept The two swap calls pass zero as the third argument: File: contracts/MyStrategy.sol 1 249 uint256 balEthBptEarned =...

Clearfy Cache < 2.0.5 - Reflected Cross-Site Scripting

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting When Disable assets manager on back-end" is off: https://example.com/wp-admin/admin.php?page=gonzales-wbcrclearfy&action=index&wbcrassetsmanager=1&a"alert/XSS/...

CVE-2021-25116

The Enqueue Anything WordPress plugin through 1.0.1 does not have authorisation and CSRF checks in the removeasset AJAX action, and does not ensure that the item to be deleted is actually an asset. As a result, low privilege users such as subscriber could delete arbitrary assets, as well as put...

Re-entrancy in wfCashERC4626.withdraw() can lead to more gains in assets

Lines of code Vulnerability details Impact The withdraw function in wfCashERC4626.sol can be re-entered at the point of redeemInternal. Assume asset tokens are sent to receiver after shares are burnt, and user re-enters withdraw after redeemInternal is completed., P.S: there's a separate issue on...

deposit through onERC1155Received can be locked by attackers, making the function useless

Lines of code Vulnerability details Impact Disable depositing through onERC1155Receive, potentially breaking all integrations using this function as entry point. Proof of concept An attacker can transfer another fCash position to the wrapper contract, which will trigger ERC1155Actions.transfer ⇒...

Loss of underlying tokens due to ERC4626 non-compliance in withdraw function in wfCashERC4626.sol

Lines of code Vulnerability details Impact The withdraw function in wfCashERC4626 is missing the code that transfers the underlying tokens to the receiver. According to the EIP-4626 standard, withdraw function Burns shares from owner and sends exactly assets of underlying tokens to receiver...

Taming the Digital Asset Tsunami

Internet Protocol IP addresses and the devices, web services and cloud assets behind them are the lifeblood of modern businesses. But too often companies amass thousands of digital assets, creating an unmanageable mess for IT and security teams. Left unchecked, a single forgotten, abandoned or...

How to Recover From a Ransomware Attack

By Owais Sultan Remediation following ransomware is a long process during which companies have to do to protect their assets and… This is a post from HackRead.com Read the original post: How to Recover From a Ransomware Attack...

GHSA-7M9H-V68W-PFW3 Neos CMS vulnerable to XSS in various backend modules

Multiple cross-site scripting XSS vulnerabilities in Neos CMS allow attackers with the editor role or higher to inject arbitrary script or HTML code using the editor function, the deletion of assets, or a workspace title. The vulnerabilities were found in versions 3.3.29 and 8.0.1 and could also ...

Security Bulletin: Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote attack due to Moment.js CVE-2022-24785

Summary Automation Assets in IBM Cloud Pak for Integration is vulnerable to remote attack due to Moment.js CVE-2022-24785 with details below Vulnerability Details CVEID:CVE-2022-24785 DESCRIPTION: Moment.js could allow a remote attacker to traverse directories on the system, caused by improper...

CVE-2021-32958

Successful exploitation of this vulnerability on Claroty Secure Remote Access SRA Site versions 3.0 through 3.2 allows an attacker with local command line interface access to gain the secret key, subsequently allowing them to generate valid session tokens for the web user interface UI. With acces...

[WP-H3] Lack of liquidation makes it possible for alToken to be undercollateralized

Lines of code Vulnerability details function liquidate address yieldToken, uint256 shares, uint256 minimumAmountOut external override lock returns uint256 onlyWhitelisted; checkArgumentshares 0; YieldTokenParams storage yieldTokenParams = yieldTokensyieldToken; address underlyingToken =...