MAL-2024-7807 Malicious code in webjsflood (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 41cce5996b48499aa091e08036886fb6c4b75bad613669a6f278e24b01bc11d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7805 Malicious code in httpsflood (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec2e3678fb0fcd1e38fa8e38b706128b14d6cd88892b5d2eace1580f584baa8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in smart-input-textarea (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8ffba47b31768b1363d5fd651769eb8bcb3f1112ca6db601bd51c7c44ec58adb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7798 Malicious code in smart-input-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1d35a2894a65ccf5f422531f46846b2cc71d5e0e28a3e0d7b6e9ed1b0daa6a69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7797 Malicious code in lol1234 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3b3ce428106be18ba286aa2669f39a4fb3e2002e6cee4ccdca452afed5c8841d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Acronis Cyber Infrastructure default password remote code execution

Acronis Cyber Infrastructure ACI is an IT infrastructure solution that provides storage, compute, and network resources. Businesses and Service Providers are using it for data storage, backup storage, creating and managing virtual machines and software-defined networks, running cloud-native...

AZL-46969 CVE-2024-1975 affecting package bind for versions less than 9.20.0-1

If a server hosts a zone containing a "KEY" Resource Record, or a resolver DNSSEC-validates a "KEY" Resource Record from a DNSSEC-signed domain in cache, a client can exhaust resolver CPU resources by sending a stream of SIG0 signed requests. This issue affects BIND 9 versions 9.0.0 through...

Mexico’s Largest ERP Provider ClickBalance Exposes 769 Million Records

ClickBalance ERP providers cloud database exposed 769 million records, including API keys and email addresses. Learn how this…...

MAL-2024-7787 Malicious code in sap-abstract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d699148992a2b2d20128893c0ba7a5d5022338a889ed430995f8dedc448f8a76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7790 Malicious code in sap-accesslevel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5a9eef95084b4052715fcbefc82b3ebb9680371d43f189ca1d39bb75af3c2a9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-7788 Malicious code in sap-ac (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 870a5115e5b80eb328e2100fc8e18af8a1dfea9e5dde756b2c4fad13bda5b53d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

EulerOS 2.0 SP8 : compat-openssl (EulerOS-SA-2024-2021)

According to the versions of the compat-openssl package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : Issue summary: Processing a maliciously formatted PKCS12 file may lead OpenSSL to crash leading to a potential Denial of Service attack...

CVE-2024-6599 Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification

The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajaxsavesettings function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and...

CVE-2024-6599 Meks Video Importer <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) API Keys Modification

The Meks Video Importer plugin for WordPress is vulnerable to unauthorized API key modification due to a missing capability check on the ajaxsavesettings function in all versions up to, and including, 1.0.12. This makes it possible for authenticated attackers, with Subscriber-level access and...

Usage of non-constant time base64 decoder could lead to leakage of secret key material

Versions before 0.7.0 of vodozemac use a non-constant time base64 implementation for importing key material for Megolm group sessions and PkDecryption Ed25519 secret keys. This flaw might allow an attacker to infer some information about the secret key material through a side-channel attack. Impa...

CVE-2024-5471

Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys...

CVE-2024-5471

Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys...

CVE-2024-5471 Agent takeover

Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys...

CVE-2024-5471 Agent takeover

Zohocorp ManageEngine DDI Central versions 4001 and prior were vulnerable to agent takeover vulnerability due to the hard-coded sensitive keys...

CVE-2024-5471

The CVE-2024-5471 entry affects Zohocorp ManageEngine DDI Central versions 4001 and prior, with an agent takeover vulnerability caused by hard-coded sensitive keys. Public data show high to critical impact (CVE scores include 8.8–9.8 base severity; network attack vector; no user interaction in so...