CVAT Security Vulnerabilities

CVAT is an interactive video and image annotation tool for computer vision. A security vulnerability exists in CVAT version 2.2.0 through versions prior to 2.14.3. An attacker exploiting this vulnerability could obtain media files, annotations, settings, and other information from any project,...

CVAT Security Vulnerabilities

CVAT is an interactive video and image annotation tool for computer vision. A security vulnerability exists in CVAT Computer Vision Annotation Tool version 2.1.0 through versions prior to 2.14.3. An attacker can exploit the vulnerability to obtain sensitive information...

PT-2024-27348 · Microsoft +1 · Azure Blob Storage +1

Name of the Vulnerable Software and Affected Versions: Computer Vision Annotation Tool CVAT versions 2.1.0 through 2.14.3 Description: The issue allows an attacker with a CVAT account to exploit a feature by specifying custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob...

CVE-2024-37164: Server-Side Request Forgery (SSRF)

Computer Vision Annotation Tool CVAT is an interactive video and image annotation tool for computer vision. CVAT allows users to supply custom endpoint URLs for cloud storages based on Amazon S3 and Azure Blob Storage. Starting in version 2.1.0 and prior to version 2.14.3, an attacker with a CVAT...

Malicious code in v2-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 51e0286004b6b184a7ae2c0a7110095cd51122ae1c9ccc69db8d1bfd7380dfed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1598 Malicious code in ozon-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6a05e800a141f7c456358b5d20b4e3cebc65f9d0229d0024fae5b1e51ed1e51 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in core-webpack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6b8224957c90ee66ed3cc6af4e8b300d5eb082f8368f94b725e53bbfed9ccbf2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1593 Malicious code in ato-z-web-identity-components-app-cdk-adp-wrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c33c62d31d74de8fa6a7a3911507ce9a8d513bccb45ff1b51b7fbb9068920d3e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1594 Malicious code in atoz-attendance-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ff390162beebf06ba564766a3ffc0a06c520792994c16cba3ea0d97ea64d1f29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in noblox.js-discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d714a330056d61b303e703615cd667da1871ff920b7563ed5d20d42d5b68c7be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1581 Malicious code in noblox.js-discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d714a330056d61b303e703615cd667da1871ff920b7563ed5d20d42d5b68c7be Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in noblox.js-proxy-agent

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2024-1578 Malicious code in dell-ui-bootstrap (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b3c479c9bdd98cd009ae28c56a47f3ef7dd2dda6d6e96abbdfc86905f79f557b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in mmsdk-apml-htmlrenderer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae0814f13d1d5f49711b30a6fe260c2bfb566047df1b02774e899421faf58c92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1576 Malicious code in code.jquery.ajax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 52954659c906ed745d4b0c4b28b77fd0637eac32a5a4229bbeb6fa5ea8f7d004 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1575 Malicious code in code.cloudflare.com (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fd0d00a0ff9a56ee7446eb2b6ffa5b59db4eb466925a2c3d769df90c00fdcd76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1574 Malicious code in code.cloudflare.ajax (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5869f17e67758b1fd6d47d84b2ab8d46f7912558ed8120de69bfc64ed5c0063d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in purina-parent-theme

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Update: CVE-2024-4577 quickly weaponized to distribute “TellYouThePass” Ransomware

Introduction Recently, Imperva Threat Research reported on attacker activity leveraging the new PHP vulnerability, CVE-2024-4577. From as early as June 8th, we have detected attacker activity leveraging this vulnerability to deliver malware, which we have now identified to be a part of the...

Malicious code in aws-logs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4707229414d50f1284c7a7b64169463a7c7ca779faf42df6b059947dfd1b79eb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...