MAL-2024-8873 Malicious code in sketch-crowdin (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 760414998be33a4144fb0eee0455cc462dea5f95e07189b1ff637271a0014974 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in roblox-tracer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a4766dbf57e00dc5b3ef46f29e17392167d207c46ccf1a6ea97fc9bcf674cb7a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8853 Malicious code in roblox-event-tracker (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6f08f30c6d48fad2d39e96f192eb0efb0ae97511a98d6ef6b3048b20486f7c30 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-12243 Malicious code in coffin-codes-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 fa99dd73d11cc6b2756fb43cff1eb16f5f80b4ffd436dbfd635b8417f821c7ba So far, it looks like a legit tunneling software, but in tcp.py there is an attempt to send a strange email using gmail. Update: Identified as malicious by...

MAL-2024-8847 Malicious code in ethersscan-api (npm)

The package contains the BeaverTail infostealer malware associated with DPRK threat actors. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2bdf32a4e45ba09760610d3f87cf8cfdae4d386a4ee4df99f1973ab577373620 Any computer that has this package installed or running shoul...

MAL-2024-8831 Malicious code in indrive-web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 011bd3f8ccaeb08ace40949b5860fb7a582858cf482c46f4e615b2b2db087e18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-45063

The function ctlwritebuffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process,...

CVE-2024-8178

The ctlwritebuffer and ctlreadbuffer functions allocated memory to be returned to userspace, without initializing it. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process, which...

CVE-2024-45063 Multiple issues in ctl(4) CAM Target Layer

The function ctlwritebuffer incorrectly set a flag which resulted in a kernel Use-After-Free when a command finished processing. Malicious software running in a guest VM that exposes virtioscsi can exploit the vulnerabilities to achieve code execution on the host in the bhyve userspace process,...

CVE-2024-43110

The CVE-2024-43110 issue affects FreeBSD ctl(4) CAM Target Layer. The ctl_request_sense function could expose up to three bytes of kernel heap to userspace. Guest VMs exposing virtio_scsi can trigger these vulnerabilities to achieve code execution on the host in the bhyve userspace process (typic...

CVE-2024-42416

CVE-2024-42416 affects FreeBSD ctl(4) CAM Target Layer: ctl_report_supported_opcodes did not properly validate a field from userspace, enabling an arbitrary write into limited kernel help memory. Impact: guest VMs using virtio_scsi can abuse this to execute code on the host bhyve process (root), ...

CVE-2024-8178

CVE-2024-8178 affects the FreeBSD ctl subsystem (ctl_write_buffer and ctl_read_buffer) where memory allocated for return to userspace was not initialized, enabling abuse via virtio_scsi in guest VMs. Exploitation could allow code execution on the host bhyve process (typically running as root), wi...

CVE-2024-41928

Malicious software running in a guest VM can exploit the buffer overflow to achieve code execution on the host in the bhyve userspace process, which typically runs as root. Note that bhyve runs in a Capsicum sandbox, so malicious code is constrained by the capabilities available to the bhyve...

CVE-2024-41928

CVE-2024-41928 affects FreeBSD bhyve: a buffer overflow in the MMIO path when TPM passthrough is enabled can let malware in a guest VM execute code on the host bhyve process (usually running as root). The FreeBSD advisory SA-24:10.bhyve documents the issue, impact, and remediation, including upgr...

MAL-2024-8826 Malicious code in sigma-errors (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3261ce8608a1d5df2dc6eea25790460c5c3acc3ff03c223d4ece32c799bde4e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in swioeur (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce43adfbfb4dffeaac71bdccc909f5f81be06022b76faea25d8fcf582f1ac51b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xwuirit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware df36d2af53be006f85a47e0a26683a059038c7f0135c497743b6b0c318d7f1b3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8781 Malicious code in lioejre (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2210c252fdd314dcf9fb63873b09b4cb94666ac597611b36276f4b2f8d5fb1cf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8818 Malicious code in zuwortr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9a6fc476831f5d1665908a5e68c190efe201ca54e85255b4572f2fd10ca6c59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8817 Malicious code in zuwoirt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 70e5c0bb7c2073b9aad16bf6ef85ed41176cc6c85197a2797fa6bb29ff439d8c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...