@5minds/processcube_engine (>=15.0.0, <=17.0.0-renovate-fffeda-lowoukm9), @alexop/express-mysql-session (2.2.0) +140 more potentially affected by CVE-2024-21509 via mysql2 (>=3.0.0, <=3.9.3)

mysql2 NPM version =3.0.0, =15.0.0, =1.0.6-beta.0, =1.0.0, =15.0.0-alpha.2, =0.1.0, =0.1.0, =0.1.0, =1.0.75, =4.38.0, =4.0.1-alpha, =0.20.0, =0.52.0, =1.6.0, =2.9.24-alpha.2, =2.23.12 and more Source cves: CVE-2024-21509 Source advisory: OSV:GHSA-49J4-86M8-Q2JW...

Raspberry Robin Returns: New Malware Campaign Spreading Through WSF Files

Cybersecurity researchers have discovered a new Raspberry Robin campaign wave that has been propagating the malware through malicious Windows Script Files WSFs since March 2024. "Historically, Raspberry Robin was known to spread through removable media like USB drives, but over time its...

Why Payers Are Pivotal to API Security Across the Healthcare Ecosystem

...

Why Payers Are Pivotal to API Security Across the Healthcare Ecosystem

...

Web3 Security Specialist Hypernative To Provide Proactive Protection To The Flare Ecosystem

By Owais Sultan Institutions, dApps and users on Flare will now benefit from Hypernative’s industry-leading ecosystem-wide protection suite. This is a post from HackRead.com Read the original post: Web3 Security Specialist Hypernative To Provide Proactive Protection To The Flare Ecosystem...

oidcc 安全漏洞

oidcc is an open source OpenId Connect client library in Erlang & Elixir by The Erlang Ecosystem Foundation. A security vulnerability exists in oidcc 3.0.0 and later, which stems from the presence of a Denial of Service DoS vulnerability...

CVE-2024-29887 Serverpod client accepts any certificate

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. This bug bypassed the validation of TSL certificates on all none web HTTP clients in the serverpodclient package. Making them susceptible to a man in the middle attack against encrypted traffic between the client device...

CVE-2024-29886 Improved security for stored password hashes

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6...

OESA-2024-1250 containers-common security update

This package contains common configuration files and documentation for container tools ecosystem, such as Podman, Buildah and Skopeo. Security Fixes: Improper exposure of client IP addresses in net/http before Go 1.17.12 and Go 1.18.4 can be triggered by calling httputil.ReverseProxy.ServeHTTP wi...

aide (>=0.1.0, <=0.4.3), bpxe (>=0.1.0, <=0.1.2) +66 more potentially affected by unknown CVE via linkme (>=0.1.6, <=0.2.10)

linkme CARGO version =0.1.6, =0.1.0, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.2-alpha, =0.0.2-alpha, =0.0.4-alpha and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2024-0407...

CVE-2024-27092

Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload external link is presented in clickable form - easier to achieve own goals by malicious actors. This iss...

Design/Logic Flaw

Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload external link is presented in clickable form - easier to achieve own goals by malicious actors. This iss...

CVE-2024-27092

CVE-2024-27092 – Hoppscotch (API development ecosystem) involves a lack of validation for the field pair Label (Edit Team) – TeamName, enabling attackers to send emails with spoofed content presented as Hoppscotch. The issue is documented to affect Hoppscotch prior to the fix and is mitigated by ...

CVE-2024-27092 Content spoofing - real Hoppscotch emails

Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload external link is presented in clickable form - easier to achieve own goals by malicious actors. This iss...

CVE-2024-27092 Content spoofing - real Hoppscotch emails

Hoppscotch is an API development ecosystem. Due to lack of validation for fields like Label Edit Team - TeamName, bad actors can send emails with Spoofed Content as Hoppscotch. Part of payload external link is presented in clickable form - easier to achieve own goals by malicious actors. This iss...

@adamlonsdale/backstage-plugin-armorcode-backend (>=0.0.1-alpha, <=0.0.4), @austin-garrard/backstage-plugin-backend (>=0.0.1-alpha.22, <=0.0.1) +194 more potentially affected by CVE-2024-26150 via @backstage/backend-common (>=0.0.0-nightly-20220708025041, <=0.17.0)

@backstage/backend-common NPM version =0.0.0-nightly-20220708025041, =0.0.1-alpha, =0.0.1-alpha.22, =0.0.1-alpha.18, =0.1.0, =0.0.0-nightly-20220709024234, =0.0.0-nightly-20220811024336, =0.0.0-nightly-20240116021644, =0.0.0-nightly-20220709024234, =0.0.0-nightly-2021101322257,...

This Week in Spring - February 20th, 2024

Hi, Spring fans! Welcome to another installment of This Week in Spring! How are you this fine 20th of February, 2024? I'm doing alright on this rainy 20th of Feburary here in San Francisco, and I hope you are too! We've got a ton of things to get into this week so let's dive right into it! Have y...

@icanbwell/composite (>=1.89.4, <=1.202.0), @icanbwell/native-components (>=0.21.6, <=0.31.0) +4 more potentially affected by CVE-2024-25466 via react-native-document-picker (>=9.0.1, <=9.1.0)

react-native-document-picker NPM version =9.0.1, =1.89.4, =0.21.6, =0.14.5, =1.1.0, =1.8.0 - @likeminds.community/feed-rn-core 0.6.0 - @likeminds.community/feed-rn-core-beta 0.0.1 Source cves: CVE-2024-25466 Source advisory: OSV:GHSA-PMGM-H3CC-M4HJ...

Celebrating Excellence: Alex Page Recognized As a CRN 2024 Channel Chief

Congratulations to Rapid7’s Vice President of Global Channel Sales, Alex Page, who is named among the newly-announced CRN 2024 Channel Chiefs! Alex, who also received this prestigious accolade in 2023, has been recognized for his outstanding contributions and expertise in driving strategic...

Mother of all Breaches may contain NEW breach data

On January 23, 2024, we reported on the discovery of billions of exposed records online, now commonly referred to as the “mother of all breaches” MOAB. Since then, the source of the dataset has been identified as data breach search engine Leak-Lookup. Prevention platform SpyCloud compared the MOA...