CVE-2024-8926: Improper Neutralization of Special Elements used in an OS Command

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows...

CLSA-2024-1728297353 kernel: Fix of 5 CVEs

drm/amd/pm: fix the Out-of-bounds read warning CVE-2024-46731 - hwmon: w83627ehf Fix underflows seen when writing limit attributes CVE-2024-46756 - hwmon: lm95234 Fix underflows seen when writing limit attributes CVE-2024-46758 - hwmon: nct6775-core Fix underflows seen when writing limit...

Advisory ROSA-SA-2024-2503

Software: wget 1.19.5 OS: ROSA Virtualization 2.1 packageevrstring: wget-1.19.5-12.rv3 CVE-ID: CVE-2024-38428 BDU-ID: 2024-04683 CVE-Crit: MEDIUM CVE-DESC.: A vulnerability in the userinfo URI component of the GNU Wget download manager is related to insecure behavior in which data that should hav...

CVE-2024-47762: Expected Behavior Violation

Backstage is an open framework for building developer portals. Configuration supplied through APPCONFIG environment variables, for example APPCONFIGbackendlistenport=7007, where unexpectedly ignoring the visibility defined in configuration schema. This occurred even if the configuration schema...

5 Must-Have Tools for Effective Dynamic Malware Analysis

Dynamic malware analysis is a key part of any threat investigation. It involves executing a sample of a malicious program in the isolated environment of a malware sandbox to monitor its behavior and gather actionable indicators. Effective analysis must be fast, in-depth, and precise. These five...

MAL-2024-12348 Malicious code in spiderai (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 cfee8e74f278d45135c11ee4ff3f18180cb2423e333934a8ba994f5e8ec48b9a Every time the user sends a message to the AI, the user IP, message as well as the response are exfiltrated to a hardcoded telegram channel. This behaviour is...

MAL-2024-9066 Malicious code in nf-cl-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 4a07e531cde3becef826740710d90cfb37d46917ae9a633d794a641b4f04c737 The OpenSSF Package Analysis project identified 'nf-cl-logger' @ 30.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-9065 Malicious code in axp-product-ducks (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 5285fb9646b0435fb4ae3204b5975277243e149fc95c187c5c65e2fa0609389e The OpenSSF Package Analysis project identified 'axp-product-ducks' @ 30.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2024-9043 Malicious code in djangopeopletest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c6617a6a6229b2e0ec3df4bda1a00109bdbc7aaff20d0fb0c305a489c9425734 The OpenSSF Package Analysis project identified 'djangopeopletest' @ 2.1.1 npm as malicious. It is considered malicious because: - The package...

MAL-2024-9041 Malicious code in dx-hotels-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 757cbf55b30ccb4cbbf7c26afbc8eb1493280155f0ae8578700044d07a611f5c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9034 Malicious code in vault-assist-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8e6cabe2402b7271a427b21266f884d7992b70f29714ab10a32aaa2eb3c56a8d The OpenSSF Package Analysis project identified 'vault-assist-tool' @ 1.5.0 npm as malicious. It is considered malicious because: - The package...

PT-2024-41825

Уязвимость утилиты factor‎ пакета базовых утилит для операционных систем GNU Core Utilities связана с зависимостью от неопределенного для каждого типа реализации поведения. Эксплуатация уязвимости может позволить нарушителю вызвать отказ в обслуживании...

MAL-2024-9003 Malicious code in lean-coffee (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 40091a9e1c992e1036913597e929c36c5b56682d022e7260f42badcc3705df8c The OpenSSF Package Analysis project identified 'lean-coffee' @ 9.0.1 npm as malicious. It is considered malicious because: - The package...

MAL-2024-8995 Malicious code in @helvetia-italia/ng-selly-components (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b24b115b5edf195eb734c3605f40d9c1b9edc8c955136b9c4409b5dd1e9d7275 The OpenSSF Package Analysis project identified '@helvetia-italia/ng-selly-components' @ 10.20.20 npm as malicious. It is considered malicious...

UBUNTU-CVE-2024-46847

In the Linux kernel, the following vulnerability has been resolved: mm: vmalloc: ensure vmapblock is initialised before adding to queue Commit 8c61291fd850 "mm: fix incorrect vbq reference in purgefragmentedblock" extended the 'vmapblock' structure to contain a 'cpu' field which is set at...

CVE-2024-23271

A flaw was found in WebKit. This flaw allows a remote attacker to trigger unexpected cross-origin behavior via a malicious website. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of...

MAL-2024-8986 Malicious code in case-result-reporter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53752de38b0f242f1a98e32994dffdc4793390a73bf2685bb38db58aff3156fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in k0m3g4-test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bd260efc78494efc57d67f6576d7ae30b8e58e866ee7a3c228692548174c1e19 The OpenSSF Package Analysis project identified 'k0m3g4-test' @ 2.999.0 npm as malicious. It is considered malicious because: - The package...

Web tracking report: who monitored users’ online activities in 2023–2024 the most

Web tracking has become a pervasive aspect of our online experience. Whether we're browsing social media, playing video games, shopping for products, or simply reading news articles, trackers are silently monitoring our online behavior, fueling the ceaseless hum of countless data centers worldwid...

kernel: nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells

In the Linux kernel, the following vulnerability has been resolved: nvmem: Fix shift-out-of-bound UBSAN with byte size cells If a cell has 'nbits' equal to a multiple of BITSPERBYTE the logic p &= GENMASKcell-nbits%BITSPERBYTE - 1, 0; will become undefined behavior because nbits modulo BITSPERBYT...