@arunava-innofied/fire (=17.0.2), @backupfire/firebase (>=1.3.0 <=1.9.1) +54 more potentially affected by CVE-2024-4128 via firebase-tools (>=10.1.2 <=13.35.1)

firebase-tools NPM version =10.1.2, =1.3.0, =0.1.0, =0.1.1, =1.2.4, =1.16.0, =1.2.17, =0.4.0, =0.9.14, =1.0.0, =2.2.0, =6.0.10 - @raiddotfarm/setup =0.1.1 and more Source cves: CVE-2024-4128 Source advisory: OSV:GHSA-RCM2-22F3-PQV3...

CVE-2024-4128

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed cal...

CVE-2024-4128 CSRF in firebase-tools emulator suite

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed cal...

CVE-2024-4128 CSRF in firebase-tools emulator suite

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed cal...

CVE-2024-4128 CSRF in firebase-tools emulator suite

This vulnerability was a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint that is used normally to export data from running emulators. If a user was running the emulator and navigated to a malicious website with the exploit on a browser that allowed cal...

CVE-2024-4128

The CVE-2024-4128 issue affects the Firebase tools emulator suite (firebase-tools). A CSRF vulnerability exists via the export endpoint that can allow a malicious website to exfiltrate emulator data when a user with the emulator open visits the site if localhost calls are possible. Affected compo...

Firebase CLI 安全漏洞

Firebase CLI is a command line tool from Firebase Inc. in the United States. A security vulnerability exists in Firebase CLI, which originated from a vulnerability that allows a user who is running the emulator to exploit the vulnerability to navigate to a malicious website on a browser that allo...

PT-2024-29345 · Firebase · Firebase-Tools

Name of the Vulnerable Software and Affected Versions: firebase-tools versions prior to 13.6.0 Description: This issue is related to a potential CSRF attack. When running the Firebase emulator suite, there is an export endpoint used to export data from running emulators. If a user is running the...

The vulnerability of the Firebase Database Check framework in the Mobile Security Framework (MobSF) allows a attacker to perform an SSRF attack.

The vulnerability of the Firebase Database Check framework used in the Mobile Security Framework MobSF for security research in mobile applications is related to insufficient validation of incoming requests. Exploiting this vulnerability allows a malicious actor to execute an SSRF attack remotely...

CVE-2024-30564

The CVE-2024-30564 issue affects andrei-tatar/nora-firebase-common in versions 1.0.41 through 1.12.2, where a crafted script submitted to the updateState parameter of updateStateInternal can enable remote code execution. Multiple sources corroborate the vulnerability’s presence across Red Hat, Ve...

PT-2024-23492 · Unknown · Inandrei-Tatar Nora-Firebase-Common

Name of the Vulnerable Software and Affected Versions: inandrei-tatar nora-firebase-common versions 1.0.41 through 1.12.2 Description: The issue allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method. This enables the...

CVE-2024-30564

An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method...

@andrei-tatar/nora-firebase-common Prototype Pollution vulnerability

An issue inandrei-tatar nora-firebase-common between v.1.0.41 and v.1.12.2 allows a remote attacker to execute arbitrary code via a crafted script to the updateState parameter of the updateStateInternal method...

Hackers Targeting Human Rights Activists in Morocco and Western Sahara

Human rights activists in Morocco and the Western Sahara region are the targets of a new threat actor that leverages phishing attacks to trick victims into installing bogus Android apps and serve credential harvesting pages for Windows users. Cisco Talos is tracking the activity cluster under the...

Starry Addax targets human rights defenders in North Africa with new malware

Cisco Talos is disclosing a new threat actor we deemed "Starry Addax" targeting mostly human rights activists associated with the Sahrawi Arab Democratic Republic SADR cause with a novel mobile malware. Starry Addax conducts phishing attacks tricking their targets into installing malicious Androi...

Server Side Request Forgery

mobsf is vulnerable to Server Side Request Forgery. The vulnerability is due to a flaw in the firebase database check logic, allowing attackers to manipulate the server to make connections to internal-only services within the organization's infrastructure when a malicious app is uploaded to the...

CVE-2024-31215

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s...

CVE-2024-31215 Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s...

CVE-2024-31215 Mobile Security Framework (MobSF) vulnerable to Server-Side Request Forgery (SSRF) in firebase database check

Mobile Security Framework MobSF is a security research platform for mobile applications in Android, iOS and Windows Mobile. A SSRF vulnerability in firebase database check logic. The attacker can cause the server to make a connection to internal-only services within the organization’s...

CVE-2024-31215

MobSF (Mobile Security Framework) is affected by a Server-Side Request Forgery (SSRF) in the firebase database check logic. The vulnerability allows an attacker to cause the MobSF server to connect to internal-only services within the organization’s infrastructure when a malicious app is uploaded...