PT-2022-19877 · Lexmark · Lexmark

Name of the Vulnerable Software and Affected Versions: Lexmark products through 2022-04-27 Description: The issue allows an attacker who has already compromised an affected Lexmark device to maintain persistence across reboots. It is due to improper input validation, which enables external contro...

MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone

Updated August 26, 2022: Added instructions to enable collection of AD FS event logs in order to search for Event ID 501, and added a new resource for AD FS audit logging in Microsoft Sentinel. Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, whi...

MagicWeb: NOBELIUM’s post-compromise trick to authenticate as anyone

Updated August 26, 2022: Added instructions to enable collection of AD FS event logs in order to search for Event ID 501, and added a new resource for AD FS audit logging in Microsoft Sentinel. Microsoft security researchers have discovered a post-compromise capability we’re calling MagicWeb, whi...

Malicious code in ceshia-node-stack (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 904b2c5f963fd4aaf932b479caed9c77968bcb1543febf18f617babba1a2444e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in simontok (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware caa06374b63fc26ac5950bd03891861724e6b84eafeeea9a17277df2116b3392 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

DoNot Team Hackers Updated its Malware Toolkit with Improved Capabilities

The Donot Team threat actor has updated its Jaca Windows malware toolkit with improved capabilities, including a revamped stealer module designed to plunder information from Google Chrome and Mozilla Firefox browsers. The improvements also include a new infection chain that incorporates previousl...

Malicious code in webpack-3undle-analyr (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 16a28366a4a6239f009a0f84d27a1ba4190b2a996fe943e1e342a7b8afce51f6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xpsaht (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 07a6dc7d48ff38aff56b235f4fbf2e20f7b3242d9e0ec5069978e68a32aa6a68 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in utia (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12a67fb1aae628b9261e13184946433947c840a938a8fa590bb91892703e678b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in yeoman-33enerator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46467411b04dd7b9a5c0f9063b47e48dcb506330bdcd90899e4e20e48de784e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in whn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 44c504d9afb10c1aaa42c206703ee6cf7fbe4fb16ff2f2a05e8f3327698b35df Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wbpac-hot-middwleware (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a0020f3d8a3814db48c3c26e4056e2056c8a00aa74c7fdd322b26b44a9a2acac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in xgzgexp (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4648b3e140e2ad4056439c03957c9d5cf660fcbce180913b9a08e4561ddabca7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in suorce-map (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0701cc6f6fa29d40dc09dd9424ce2419cb2621996a99965b425ffd32ca243985 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in supoertes (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbbb9e497d9bd4ea9898e4b74ff87df9e7a36df710798e33dbfb49288a4eee02 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tld5ify (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9fb794a4f2a745c62be577d5ab848d94c09fe7d177c0fabec77576467a063a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in stlintreact (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46a42e5a42bd487ff77113cad38587ecfac3eacd0d0df323070f2c5fe8931ef4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tslnit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea51f13bd4617c244c7581bc7fcdf5777ade342633b48d55bbacaaa944f096a7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sqwli3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec85baa93fd33f46def340f0154546a0ae72db52aae633a54982b3a6b489f12e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in sysezjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 651a5b2d4e206e0f0700366ce58d1148feb5336f903b4cff8973c63f5f30d7d7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...