Malicious code in ejs-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6005ef8f32d3d8160fb459ec4f885c273bd8721ab0becf21fe4d27accdf4d21d Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-947 Malicious code in vue-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d83b4e200320d89600b71bfb94b2106e5e01fe0c319873c9dac9b0d9661447da Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-302 Malicious code in ejs-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6005ef8f32d3d8160fb459ec4f885c273bd8721ab0becf21fe4d27accdf4d21d Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

CVE-2023-20885 CF workflows leak credentials in system audit logs

Vulnerability in Cloud Foundry Notifications, Cloud Foundry SMB-volume release, Cloud FOundry cf-nfs-volume release.This issue affects Notifications: All versions prior to 63; SMB-volume release: All versions prior to 3.1.19; cf-nfs-volume release: 5.0.X versions prior to 5.0.27, 7.1.X versions...

Cloud Foundry 日志信息泄露漏洞

Cloud Foundry is a suite of open source Platform-as-a-Service PaaS cloud computing platforms from the U.S.-based Cloud Foundry Foundation. The product provides features such as container scheduling, continuous delivery, and automated service deployment. A security vulnerability exists in Cloud...

In Healthcare Organizations, Data Security Risks Persist Despite HIPAA Compliance

In a recent blog post, we discussed the extraordinarily powerful “perfect storm” of cyber risk faced by healthcare organizations today. This storm is escalating in size, force, and risk levels. The Health Insurance Portability and Accountability Act HIPAA sets the standard for protecting this dat...

Barracuda Networks Releases Update to Address ESG Vulnerability

Barracuda Networks has released an update to their advisorylink is external addressing a vulnerability—CVE-2023-2868—in their Email Security Gateway Appliance ESG. According to Barracuda, customers should replace impacted appliances immediately. CISA urges organizations to review the Barracuda...

Malicious code in audit-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d1d3fc765f4abce4b198aff5193624f464377e18c77302c696ef9e200869dcb6 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-112 Malicious code in audit-ejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx cc5e978bbf3ec0126449bcb0fd362d6238bf3e8658c2e85a28fa9f68128e7227 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

MAL-2023-113 Malicious code in audit-vue (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx d1d3fc765f4abce4b198aff5193624f464377e18c77302c696ef9e200869dcb6 Lazarus Group targeting blockchain and cryptocurrency companies by exploiting software supply chains through malicious npm packages and social engineering...

CVE-2023-20885: CF workflows leak credentials in system audit logs | Cloud Foundry

Severity Medium Vendor Cloud Foundry Foundation Description Cloud foundry team found that the kernel audit logging is enabled on some components due to which various lifecycle workflows in the platform that use admin or service credentials in invocations of binaries are picked up by the audit...

com.100shouhou.golddata:golddata-spider (>=1.1.1 <=1.1.4), com.buession.cas:buession-cas-audit (>=2.0.0 <=2.3.2) +704 more potentially affected by CVE-2023-34620 via org.hjson:hjson (>=1.0.0 <=3.0.0)

org.hjson:hjson MAVEN version =1.0.0, =1.1.1, =2.0.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.3.0, =2.0.0, =1.1.0, =2.3.0, =1.1.0, =2.3.0, =2.3.2 and more Source cves: CVE-2023-34620 Source advisory: OSV:GHSA-5WFC-HJRC-GQ87...

Critical Security Vulnerability Discovered in WooCommerce Stripe Gateway Plugin

A security flaw has been uncovered in the WooCommerce Stripe Gateway WordPress plugin that could lead to the unauthorized disclosure of sensitive information. The flaw, tracked as CVE-2023-34000, impacts versions 7.4.0 and below. It was addressed by the plugin maintainers in version 7.4.1, which...

Comparing Ether values using equality operators (== or !=) can be very hard to match each other . This will always reverts

Lines of code Vulnerability details Impact Comparing Ether values using equality operators can be very hard to match each other because Ether values are stored in a 256-bit unsigned integer uint256 in Solidity. This means that there are a very large number of possible Ether values, and it is very...

Arbitrary delegatecalls from LlamaAccount can be used to steal assets

Lines of code Vulnerability details Impact Using delegatecall to call arbitrary contracts is highly dangerous as it can be used to steal assets. An attacker could sneak in a contract that steals all the assets owned by the LlamaAccount contract. Proof of Concept Below is a diff to the existing...

Nextcloud: Issuer not verified from obtained token in user_oidc

The issuer verification in the useroidc app of Nextcloud did not properly validate the issuer of the obtained token, potentially allowing for a Man-in-the-Middle attack...

CVE-2023-0993

The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a...

CVE-2023-0993

The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a...

Cross site scripting

The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a...

CVE-2023-0993 Shield Security <= 17.0.17 - Missing Authorization

The Shield Security plugin for WordPress is vulnerable to Missing Authorization on the 'theme-plugin-file' AJAX action in versions up to, and including, 17.0.17. This allows authenticated attackers to add arbitrary audit log entries indicating that a theme or plugin has been edited, and is also a...