958 matches found
Malicious code in auth0-dashboard-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd3d9dcd233e8f88bec84813744dcf3ea68a677d4025fd66d55d2f1190be1b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-7093 Malicious code in auth0-authz-extension (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ddc031877d6efc19470df3d757e067cb9fd38974fd69be4140e854f2ca69840 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-7094 Malicious code in auth0-dashboard-widget (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cd3d9dcd233e8f88bec84813744dcf3ea68a677d4025fd66d55d2f1190be1b36 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malware in auth0-mailchimp-export
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
Malicious code in auth0-mailchimp-export (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c2f2ab30602da138b3668767294a045502dabcc11b0db0aa9c89dd18de4ab0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2024-7087 Malicious code in auth0-mailchimp-export (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c2f2ab30602da138b3668767294a045502dabcc11b0db0aa9c89dd18de4ab0f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in auth0.net (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299295a8f62b96e6336a60ce85d2212185bf0cf424cc548d8bca9f0b14ed85c1 On npm install, package.json's preinstall and preupdate/test hook runs nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun. The destination oast.fun ...
MAL-2024-1783 Malicious code in auth0.net (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 299295a8f62b96e6336a60ce85d2212185bf0cf424cc548d8bca9f0b14ed85c1 On npm install, package.json's preinstall and preupdate/test hook runs nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun. The destination oast.fun ...
Okta Discloses Broader Impact Linked to October 2023 Support System Breach
Identity services provider Okta has disclosed that it detected "additional threat actor activity" in connection with the October 2023 breach of its support case management system. "The threat actor downloaded the names and email addresses of all Okta customer support system users," the company sa...
Leaving Authentication Credentials in Public Code
Interesting article about a surprisingly common vulnerability: programmers leaving authentication credentials and other secrets in publicly accessible software code: Researchers from security firm GitGuardian this week reported finding almost 4,000 unique secrets stashed inside a total of 450,000...
Security Bulletin: Multiple vulnerabilities in jsonwebtoken package affects Data Replication on Cloud Pak for Data
Summary Multiple vulnerabilities in jsonwebtoken package used in Data Replication on Cloud Pak for Data was addressed. Vulnerability Details CVEID:CVE-2022-23541 DESCRIPTION: Auth0 jsonwebtoken could allow a remote authenticated attacker to bypass security restrictions, caused by an insecure...
Malicious code in auth0-playground (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4267198f7d6d37ea13e1bdc92116960ceef69ae0ac639131ebf85d223180dd22 The OpenSSF Package Analysis project identified 'auth0-playground' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
MAL-2023-1508 Malicious code in auth0-playground (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4267198f7d6d37ea13e1bdc92116960ceef69ae0ac639131ebf85d223180dd22 The OpenSSF Package Analysis project identified 'auth0-playground' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...
Security Bulletin: IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions due to [CVE-2022-23539], [CVE-2022-23540] and [CVE-2022-23541]
Summary Node.js module Auth0 jsonwebtoken is used by IBM App Connect Enterprise Certified Container for generating, parsing and verifying JWTs. IBM App Connect Enterprise Certified Container operands may be vulnerable to bypassing of security restrictions. This bulletin provides patch information...
Security Bulletin: IBM Spectrum Discover is vulnerable to multiple vulnerabilities
Summary IBM has addressed multiple vulnerabilities in IBM Spectrum Discover. Webpack loader-utils CVE-2022-37601 is vulnerable to execute arbitrary code on the system caused by a pollution flaw in parseQuery function. OpenStack Keystone CVE-2021-3563 is vulnerable to bypass security restriction...
Security Bulletin: IBM Security Verify Information Queue has multiple third-party library vulnerabilities
Summary IBM Security Verify Information Queue ISIQ v10.0.5 has remediated vulnerabilities in the third-party libraries that it uses. Vulnerability Details CVEID:CVE-2022-41946 DESCRIPTION: Postgresql JDBC could allow a local authenticated attacker to obtain sensitive information, caused by not...
Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in jsonwebtoken
Summary Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in jsonwebtoken with details below. Vulnerability Details CVEID:CVE-2022-23540 DESCRIPTION: Auth0 jsonwebtoken could allow a remote authenticated attacker to bypass securit...
Security Bulletin: Vulnerabilities in jsonwebtoken affects IBM Watson Assistant for IBM Cloud Pak for Data
Summary Potential vulnerabilities in Jsonwebtoken has been identified that may affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information. Vulnerability Details CVEID:CVE-2022-23541 DESCRIPTION: Auth0 jsonwebtoken could allow a remote authenticated attacke...
Security Bulletin: IBM Decision Optimization in IBM Cloud Pak for Data is vulnerable to jsonwebtoken CVEs
Summary There are multiple vulnerabilities in JSON Web Token implementation used by IBM Decision Optimization in IBM Cloud Pak for Data. IBM Decision Optimization in IBM Cloud Pak for Data has addressed the applicable CVEs. Vulnerability Details CVEID:CVE-2022-23541 DESCRIPTION: Auth0 jsonwebtoke...
