Session fixation

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

CVE-2023-45718 HCL Sametime is impacted by a failure to invalidate sessions

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

CVE-2023-45718: Session Fixation

Sametime is impacted by a failure to invalidate sessions. The application is setting sensitive cookie values in a persistent manner in Sametime Web clients. When this happens, cookie values can remain valid even after a user has closed out their session...

CVE-2024-23452 Apache bRPC: HTTP request smuggling vulnerability

Request smuggling vulnerability in HTTP server in Apache bRPC 0.9.51.7.0 on all platforms allows attacker to smuggle request. Vulnerability Cause Description： The httpparser does not comply with the RFC-7230 HTTP 1.1 specification. Attack scenario: If a message is received with both a...

Cloudflare Breach: Nation-State Hackers Access Source Code and Internal Docs

Cloudflare has revealed that it was the target of a likely nation-state attack in which the threat actor leveraged stolen credentials to gain unauthorized access to its Atlassian server and ultimately access some documentation and a limited amount of source code. The intrusion, which took place...

Malicious code in node-production (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 20bbb441be4cc94e35a3bf9c020b6d6106d034a75a335ae40fe4528934720fe0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CherryTree Impostor Dubbed CherryLoader Makes Its Move

Summary: CherryLoader, a new Go-based downloader, has surfaced in cyber attacks, masquerading as the legitimate CherryTree note-taking app. This sophisticated threat infiltrates compromised hosts, delivering malicious payloads such as privilege escalation tools for exploitation and persistent...

ASB-A-300741186

In removePersistentDot of SystemStatusAnimationSchedulerImpl.kt, there is a possible race condition due to a logic error in the code. This could lead to local escalation of privilege that fails to remove the persistent dot with no additional execution privileges needed. User interaction is not...

BIT-REVIEWBOARD-2021-31330

A Cross-Site Scripting XSS vulnerability exists within Review Board versions 3.0.20 and 4.0 RC1 and earlier. An authenticated attacker may inject malicious Javascript code when using Markdown editing within the application which remains persistent...

Malicious code in wlwz-2312-6802 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d4a48a8fcdb28633f92dd057bc5d3d5d23bde5125b348b9e3b31c97d09bdee12 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-5604 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6963caefff4a061651d4c8afe98aa2ecad2483accb3ff5b65aef1fdecfba5ec0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-4807 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b18e5e39a5429b6581b662603e2cdc68aa4bbf45ccd6bd7b57ab11e59e70b9a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-4701 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5647e3b4fee9f16ffbe29eb2b149fff29235e592669b9e4aec6ac1de97016a24 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-4501 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 036f5d88d253076aad18f9d87dc4e849029773159ccedf2c1ef7262a7f6bfb60 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-1902 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 74c44976276b6a81564e2f0192ec068a9e1f855cdf778ec96739abcf75a5f678 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-1406 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 03eda098bfd8ff06bfbffb6c4597c551d64c94aa280d2746277f582d353a30b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-1502 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b419fbe7b34074ccbdb7a8d3f4ba78e4cf2ce4ec98b0890a6c00bf046cf4287d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-1505 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f2786b0a34c606098989d37d5d7f1e5f8b78e941c421c74891d3bb3bf5da4d0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in wlwz-2312-0105 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4c47f5ea7a884813c3a0334369a38c3fc527da728f62f44acf79e2c716f52f3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ScarCruft Unleashes Tailored Attacks on Cybersecurity Frontlines

Summary: The ScarCruft APT group is actively targeting attacks on media organizations and individuals in the realm of threat intelligence. ScarCruft employs persistent tactics, using phishing emails to deliver RokRAT, a custom-designed backdoor. Threat Level - Amber | Attack Report For a detailed...