MAL-2025-22279 Malicious code in haven-qoxpr-q6vgc-zenith-project (npm)

The package haven-qoxpr-q6vgc-zenith-project was found to contain malicious code...

Malicious code in haven-ilsmr-kgh8y-ice-project (npm)

The package haven-ilsmr-kgh8y-ice-project was found to contain malicious code...

MAL-2025-22278 Malicious code in haven-ilsmr-kgh8y-ice-project (npm)

The package haven-ilsmr-kgh8y-ice-project was found to contain malicious code...

MAL-2025-22282 Malicious code in haven-wyjzj-i1oih-frost-project (npm)

The package haven-wyjzj-i1oih-frost-project was found to contain malicious code...

CVE-2024-39906

A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires authentication, but an attacker can craft a link that they can pass to a logged in administrator of the blog software. This leads t...

CVE-2024-39906

The CVE-2024-39906 vulnerability affects the Haven blog web application (Ruby on Rails) via its IndieAuth functionality. A logged-in administrator can be forced to click a crafted link that executes arbitrary commands on the server, enabling Remote Code Execution (RCE). The root cause is a comman...

PT-2024-28724 · Unknown +1 · Ruby On Rails +1

Name of the Vulnerable Software and Affected Versions: Haven blog web application affected versions not specified Description: A command injection vulnerability was found in the IndieAuth functionality of the Ruby on Rails based Haven blog web application. The affected functionality requires...

new-haven-theater.com Cross Site Scripting vulnerability OBB-3267801

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...

CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...

CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...

CVE-2023-24060

Haven 5d15944 allows Server-Side Request Forgery SSRF via the feedurl= Feeds functionality. Authenticated users with the ability to create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname or even the hostname of the Haven server itself. NOTE: this product has significant usage but...

CVE-2023-24060

Haven 5d15944 contains a Server-Side Request Forgery (SSRF) in the feed[url] Feeds functionality. An authenticated user who can create new RSS Feeds or add RSS Feeds can supply an arbitrary hostname (including the Haven server’s own hostname). The vulnerability description does not specify an aff...

github haven 代码问题漏洞

github haven is a software application. self-hostable private blog. A security vulnerability exists in Haven version 5d15944, which can be exploited by an attacker to create new RSS feeds...

Crypto-inspired Magecart skimmer surfaces via digital crime haven

This blog post was authored by Jerome Segura Online criminals rarely reinvent the wheel, especially when they don't have to. From ransomware to password stealers, there are a number of toolkits available for purchase on various underground markets that allow just about anyone to get a jumpstart...

Malicious code in haven-design-system-static (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e6e21f6d3eedab2006dc0ba57aa92a86359bd49c3efaf11ec455beeeeef024a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3568 Malicious code in haven-design-system-static (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e6e21f6d3eedab2006dc0ba57aa92a86359bd49c3efaf11ec455beeeeef024a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

remotesupport.newhaven.edu Cross Site Scripting vulnerability OBB-2496847

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

VMware Carbon Black TAU Malware Analysis: Tofsee Botnet Resurfaces

Tofsee is a botnet which has not been reported on since the following analysis in September of 2016 by the Cert Polka team and Cisco Talos. This updated campaign employs new techniques in order to aggressively send large volumes of spam emails primarily targeting the adult dating scene. This new...

Threat Analysis Unit (TAU) Threat Intelligence Notification: Tofsee Botnet

Tofsee is a botnet which has not been reported on since the following analysis in September of 2016 by the Cert Polka team and Cisco Talos. This updated campaign employs new techniques in order to aggressively send large volumes of spam emails primarily targeting the adult dating scene. This new...