From ChatBot To SpyBot: ChatGPT Post Exploitation

In the second installment of our blog post series on ChatGPT, we delve deeper into the security implications that come with the integration of AI into our daily routines. Building on the discoveries shared in our initial post, "XSS Marks the Spot: Digging Up Vulnerabilities in ChatGPT," where we...

BIT-GITLAB-2021-39866

A business logic error in the project deletion process in GitLab 13.6 and later allows persistent access via project access tokens...

Cloudflare Breach: Nation-State Hackers Access Source Code and Internal Docs

Cloudflare has revealed that it was the target of a likely nation-state attack in which the threat actor leveraged stolen credentials to gain unauthorized access to its Atlassian server and ultimately access some documentation and a limited amount of source code. The intrusion, which took place...

Malicious code in wlwz-2312-1505 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f2786b0a34c606098989d37d5d7f1e5f8b78e941c421c74891d3bb3bf5da4d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-0105 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c47f5ea7a884813c3a0334369a38c3fc527da728f62f44acf79e2c716f52f3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware Leveraging Google OAuth for Persistent Account Access

Summary: Information-stealing malware is actively exploiting an undisclosed Google OAuth endpoint called MultiLogin. This technique was initially disclosed by a threat actor named PRISMA on their Telegram channel and has subsequently been integrated into various malware-as-a-service MaaS stealer...

OilRig Group Unleashes Three New Malware Strains

Summary: The Iranian state-sponsored threat actor, commonly referred to as OilRig, implemented three distinct downloader malware variants throughout the year 2022. The primary objective was to sustain persistent access to targeted organizations located in Israel. OilRig demonstrated active...

Malicious code in 2e6d5f64604be31 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac5657b36ff4ea9f051859c1d7f0d6c56e2f56a183ac03f41a104cbc8a629f42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SUSE CVE-2015-8314

The Devise gem before 3.5.4 for Ruby mishandles Remember Me cookies for sessions, which may allow an adversary to obtain unauthorized persistent application access...

CVE-2023-46743

application-collabora is an integration of Collabora Online in XWiki. As part of the application use cases, depending on the rights that a user has over a document, they should be able to open the office attachments files in view or edit mode. Currently, if a user opens an attachment file in edit...

Multiple North Korean threat actors exploiting the TeamCity CVE-2023-42793 vulnerability

Since early October 2023, Microsoft has observed two North Korean nation-state threat actors – Diamond Sleet and Onyx Sleet – exploiting CVE-2023-42793, a remote-code execution vulnerability affecting multiple versions of JetBrains TeamCity server. TeamCity is a continuous integration/continuous...

Malicious code in slot-qris-situs-slot-mudah-maxwin-24-jam-online-terpercaya (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e7024e3e37cd20e39f30c363c32d2da667b32231695491e01709a7ed3fad3a09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in fas_elbridge_server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9eeb55ec40cca8a30b5ca2b20ede9234fa59a23da2fa5cef2ad9c3e461eba4c9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Uptime Kuma License Issue Vulnerability

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from the individual developer Louis Lam. An authorization issue vulnerability exists in Uptime Kuma versions prior to 1.23.3, which stems from a lack of session token validation after a password change or after a period of inactivity, and...

Malicious code in emon-testt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc3e1ddd0c9bd0c6e361f9383435fa90d24ddfb9642622862818d1aecfe88d29 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Emerging Attacker Exploit: Microsoft Cross-Tenant Synchronization

Attackers continue to target Microsoft identities to gain access to connected Microsoft applications and federated SaaS applications. Additionally, attackers continue to progress their attacks in these environments, not by exploiting vulnerabilities, but by abusing native Microsoft functionality ...

Hackers Abusing Cloudflare Tunnels for Covert Communications

New research has revealed that threat actors are abusing Cloudflare Tunnels to establish covert communication channels from compromised hosts and retain persistent access. "Cloudflared is functionally very similar to ngrok," Nic Finn, a senior threat intelligence analyst at GuidePoint Security,...

PicassoLoader Malware Used in Ongoing Attacks on Ukraine and Poland

Government entities, military organizations, and civilian users in Ukraine and Poland have been targeted as part of a series of campaigns designed to steal sensitive data and gain persistent remote access to the infected systems. The intrusion set, which stretches from April 2022 to July 2023,...

CVE-2023-2788

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated...

Buffer overflow

Mattermost fails to check if an admin user account active after an oauth2 flow is started, allowing an attacker with admin privileges to retain persistent access to Mattermost by obtaining an oauth2 access token while the attacker's account is deactivated...