MAL-2023-383 Malicious code in fca-anup-candy (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c1b28b1796fa7c3129bcc7b1876c33e7f83c54d31ecae39ceb59f543d2194f28 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in py-candyultra (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b214c4ec68d6647723a41f90415618abdfde81d1f0e382bfa5fc055639c3de61 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

GHSA-9V25-R5Q2-2P6W Candy Machine Set Collection During Mint Missing Check

A problem with Candy Machine V2 allow minting NFTs to an arbitrary collection due to a missing check. Here is a description of the exploit: Details: Here is the tx/ix to exploit: Transaction: Ix 1: candymachine v2, mintnft, passing in empty metadata -1 Ix 2: custom handler, 0 cpi A -- tokenmetada...

Candy Machine Set Collection During Mint Missing Check

A problem with Candy Machine V2 allow minting NFTs to an arbitrary collection due to a missing check. Here is a description of the exploit: Details: Here is the tx/ix to exploit: Transaction: Ix 1: candymachine v2, mintnft, passing in empty metadata -1 Ix 2: custom handler, 0 cpi A -- tokenmetada...

PT-2022-28230 · Unknown · Candy Machine V2

Name of the Vulnerable Software and Affected Versions: Candy Machine V2 Description: A problem with Candy Machine V2 allows minting NFTs to an arbitrary collection due to a missing check. The issue can be exploited through a specific transaction sequence, involving two instructions. The first...

CVE-2021-24839

The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsctickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the setdeletepermanentlybulkticket settingaction. Other actions may be affected as well...

candygourmet.ru Improper Access Control vulnerability OBB-2260900

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Ransomware Sinks Teeth into Candy-Corn Maker Ahead of Halloween

The manufacturer of some of Halloween’s most popular sweet treats has been hit with a ransomware attack that disrupted production mere weeks before the candy industry’s biggest holiday. Chicago-based Ferrara Candy Co. confirmed publicly that a cyber-incident that encrypted some of its systems on...

Malicious Package

Overview candy-check is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using candy-check...

Malicious Package

Overview rspec-candy is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using rspec-candy...

candyindustry.com XSS vulnerability

Open Bug Bounty ID: OBB-653352 Description| Value ---|--- Affected Website:| candyindustry.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

candyindustry.com XSS vulnerability

Open Bug Bounty ID: OBB-622847 Description| Value ---|--- Affected Website:| candyindustry.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

candy.multimarque.fr XSS vulnerability

Open Bug Bounty ID: OBB-496570 Description| Value ---|--- Affected Website:| candy.multimarque.fr Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Friday Squid Blogging: Make-Your-Own Squid Candy

It's Japanese. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Candy Chat Cross-Site Scripting Vulnerability

Candy Chat is an open source multi-user chat software based on the XMPP protocol. A cross-site scripting vulnerability exists in Candy Chat. A remote attacker can exploit this vulnerability to execute code on a page via message senders...

Candy Crush Saga - Dangerous filesystem permissions, Exported ContentProvider, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Candy Crush Saga published at the 'play' market has multiple vulnerabilities...

Escape Candy Rooms - Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application Escape Candy Rooms published at the 'play' market has multiple vulnerabilities...

Little Panda's Candy Shop - Customized SSL, Dangerous filesystem permissions, Redefined SSL Common Names verifier vulnerabilities

HackApp vulnerability scanner discovered that application Little Panda's Candy Shop published at the 'play' market has multiple vulnerabilities...

Candy Planet Factory Chef - Customized SSL, Dangerous filesystem permissions, Hardcoded secrets vulnerabilities

HackApp vulnerability scanner discovered that application Candy Planet Factory Chef published at the 'play' market has multiple vulnerabilities...

Make Gummy Bear - Candy Maker - Dangerous filesystem permissions, WebView code execution vulnerabilities

HackApp vulnerability scanner discovered that application Make Gummy Bear - Candy Maker published at the 'play' market has multiple vulnerabilities...