MAL-2024-9354 Malicious code in down-lo-ad-now-zip-mp3-61269-billy-mann-9mfek-wlvmjv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1e91485877216aa978237d462f08009f418e00a915794963346cc39cb14f264 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9362 Malicious code in down-load-available-zip-now-365509-chew-the-scenery-ymqd7-xaqqmu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39470e2ad654687e0841bb2740b376632c07ad817ddd755c4037149fb3872220 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9360 Malicious code in down-load-available-zip-now-23630-non-stop-je-te-plie-en-deux-6jxm0-xjqkwj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 382006e2345d556d86f24dd65c61ef384292eebd06018746c90fcb445fb9f06e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9377 Malicious code in mp3-do-wnload-file-to-day-273202-shadow-of-fear-t2vwz-niymvj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14ae460e22257b2e986bf08dcb67cb44de7a372e5e84275e6896a9ecc6818cb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9345 Malicious code in availab-le-alb-um-zip-26387-this-is-the-second-album-of-a-band-called-adebisi-shank-pdmrd-ikxtvt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49e49a7981d176acea58956a8041e33887f222b2775dc802bf49a49e1a733998 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9355 Malicious code in down-lo-ad-now-zip-mp3-6766-the-empyrean-bn3pu-tdpbau (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50bec20bf674a45f119e4fb003bb3ac0bce20575c1d225eb4816f20bc5e76549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Privilege Escalation

Tgithub.com/talos-systems/talos is vulnerable to Privilege Escalation. The vulnerability is due to improper validation of the requests during the certificate signing process for worker nodes in the Talos cluster. It allows a control plane node to issue Talos API certificates that grant unauthoriz...

Malicious code in module-grab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb37f88f9f6a37fa239ee1d591acdd1ee642b1d6447cba12accde00c474a94bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9167 Malicious code in new-code-script-down-lo-ad-jjsploit-roblox-executor-fi7j8p (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ba7e29bf181a9fc2806a8929c4fbd604f9ac9bf7d14d4b59b0fdd97918b3194 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9157 Malicious code in knu2bb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 244d62f88aebd6b02796516f10f0cb8eba074b905b90a8c3cb938789c12c04f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9215 Malicious code in ads-api-report-fetcher (npm)

The package contains code to exfiltrate local machine information to a remote server over DNS. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57e20c733e3432bce50d7684946f0b982e3dd599d8a2df2689208afe1237c24d Any computer that has this package installed or running...

MAL-2024-9076 Malicious code in dsp_login_front (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7af276e10932b2793bd4d19b246087ea006054e2fa3f0cc1907fd11be997b747 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Express.js Express-Session Weak Secret Key

Express.js applications with Express-Session use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in an environment variable and is used for multiple security-critical operations. When a weak or easily...

Express.js Cookie-Session Weak Secret Key

Express.js applications with Cookie-Session use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in an environment variable and is used for multiple security-critical operations. When a weak or easily...

CVE-2024-8775 Ansible-core: exposure of sensitive information in ansible vault files due to improper logging

A flaw was found in Ansible, where sensitive information stored in Ansible Vault files can be exposed in plaintext during the execution of a playbook. This occurs when using tasks such as includevars to load vaulted variables without setting the nolog: true parameter, resulting in sensitive data...

MAL-2024-8854 Malicious code in evolution-ds (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 319dd750e62370dfbc8bfdc0a3a2abcf5492d5a599b1a6c67a08ac126170df8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-38642 QuMagie

An improper certificate validation vulnerability has been reported to affect QuMagie. If exploited, the vulnerability could allow local network users to compromise the security of the system via unspecified vectors. We have already fixed the vulnerability in the following version: QuMagie 2.3.1 a...

MAL-2024-8186 Malicious code in @diotoborg/consequuntur-laboriosam (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware eb49cd0fe77b24fa2166acdb2c6e1d966e2c26cd158b50dc2bd961547f9dfc48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8147 Malicious code in @diotoborg/aspernatur-nihil (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ba4787ce555c29037ffceab8a4a2541243ce990d4044e396f6eec4982ec77f3a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-8109 Malicious code in @diotoborg/ad-rerum (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a2298e095ee31855c1ee771a3ff80e0fb74d27473fc63bb72997365f30c50149 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...