Anchor 安全漏洞

Anchor is an open source lightweight blogging system. A security vulnerability exists in Anchore Enterprise anchorectl version 0.1.4, which stems from incorrectly stored credentials when generating the software bill of materials. anchorectl will add credentials used to access the Anchore Enterpri...

User Private Files < 1.1.3 - Subscriber+ Arbitrary File Upload

The plugin does not filter file extensions when letting users upload files on the server, which may lead to malicious code being uploaded. 1 Create a file named exploit.php, which contains: ?php phpinfo; 2 Find the upfajaxnonce on the site's front page. 2 Run the following cURL request, curl --ur...

Malicious code in umqvjsxdkchroifn (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5cbec90806ad6801ed1c8711b71e98563cea9bd4cefa17bf16d9f683de9c41a9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pntovlwumqkzryai (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e89bb56f6ab220765357b9d4c79c553f506e7d0f51498dc456526fa1be007856 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6619 Malicious code in toxpbqrshydnclkm (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f68c2ebab87c2e4bd5e87c3842f0d075d9408dae53172a42707ba5904c203ac5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Fake job offer leads to $600 million theft

Back in March, popular NFT battler Axie Infinity lay at the heart of a huge cryptocurrency theft inflicted on the Ronin network. From the Ronin newsletter: There has been a security breach on the Ronin Network. Earlier today, we discovered that on March 23rd, Sky Mavis’s Ronin validator nodes and...

MAL-2022-4943 Malicious code in npm_jithin_package (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware fe6d3415e7a0c1e5adbb042b381add7fda870b487e95f01cf92f736d0af21578 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Nakama 安全漏洞

Nakama is a distributed server for social and real-time games and applications. A security vulnerability exists in Nakama version 3.12.0 that stems from the fact that the Nakama console does not have any limit on the number of unsuccessful login attempts within a short period of time...

GitLab 安全漏洞

GitLab is an open source, end-to-end software development platform from GitLab, Inc. with built-in version control, issue tracking, code review, CI/CD Continuous Integration and Continuous Delivery and other features. A security vulnerability exists in GitLab CE/EE versions 13.7 through 14.10.5 o...

Multiple Backdoored Python Libraries Caught Stealing AWS Secrets and Keys

Researchers have discovered a number of malicious Python packages in the official third-party software repository that are engineered to exfiltrate AWS credentials and environment variables to a publicly exposed endpoint. The list of packages includes loglib-modules, pyg-modules, pygrata,...

AAmiles 安全漏洞

AAmiles is a machine learning project scanner. AAmiles suffers from a security vulnerability. An attacker exploited the vulnerability to access sensitive user information and digital currency keys, as well as to elevate privileges...

AAmiles 安全漏洞

AAmiles is a machine learning project scanner. AAmiles suffers from a security vulnerability. An attacker exploited the vulnerability to access sensitive user information and digital currency keys, as well as to elevate privileges...

MAL-2022-22 Malicious code in 1uphealth-demo-web-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 48e9160c131034f957f1b96525b7b55a425dac218da246a585fa8bc8c00e3628 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3039 Malicious code in finastra-design-system (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 98f06ed0cb2ce7de70bb48dced08c5541ad79dad1c3d21a604eed4f010314fcf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2725 Malicious code in ember-views (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b50e3f76a23775a6e71d9236015022feb7e0cc976561a428854ee81cdde8be9f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-3969 Malicious code in isomsorphic-react-dom (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware af5cb42b8400c90362f3b20685e648e98824dfcbfb667b1af00eba3754bdd507 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1007 Malicious code in angular-directive-seed (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b65edec48fbdec50ab250165d39a7a767dc0050c8c47dc15b9d929f8b120dc65 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4968 Malicious code in nubank-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a143a5836a77bcc4ae557d0d0229d062b8b235dd9db730d74f5fbc233fca9512 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2901 Malicious code in evil-test-1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5048a00a2021f79ef262234d0fbbc95d2a2c3f1cebcf2799666295c6fefbaace Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-5250 Malicious code in paytm-blink-checkout-react-example (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 385c2fcacf3dc11e4b650087cb43c2981965b79ff503bf07434e1464fd9a131d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...