MAL-2024-10537 Malicious code in bitg (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5873ad35787d629fabac94d5b65ecbfa902739a18c0c003be4656859afd38c92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10439 Malicious code in trufel (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d86a742d041b19705edba4466a1fbcb6df551d110ed63b40b34e222b6e8821e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2024-51381

Cross-Site Request Forgery CSRF vulnerability in JATOS v3.9.3 that allows attackers to perform actions reserved for administrators, including creating admin accounts. This critical flaw can lead to unauthorized activities, compromising the security and integrity of the platform, especially if an...

CVE-2024-51381

Summary: CVE-2024-51381 is a CSRF flaw in JATOS v3.9.3 that lets attackers perform administrator-only actions, including creating admin accounts. The Red Hat, NVD, OSV, CNNVD, and CVE records corroborate the issue across sources. Affected component/version: JATOS 3.9.3. Root cause / nature: Cross...

CVE-2024-51362

The CVE-2024-51362 entry affects LSC Smart Connect Indoor IP Camera V7.6.32. The Red Hat NVD references and other sources confirm an information-disclosure flaw where live footage can be accessed via RTSP on port 8554 without authentication, enabling unauthorized network access to the camera feed...

MAL-2024-10341 Malicious code in puppeteer-extra-stealth (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b37fbc6ab229a243ce69502d1a45b114b8b4c6318a961389367378d664f35b03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9355 Malicious code in down-lo-ad-now-zip-mp3-6766-the-empyrean-bn3pu-tdpbau (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50bec20bf674a45f119e4fb003bb3ac0bce20575c1d225eb4816f20bc5e76549 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9377 Malicious code in mp3-do-wnload-file-to-day-273202-shadow-of-fear-t2vwz-niymvj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14ae460e22257b2e986bf08dcb67cb44de7a372e5e84275e6896a9ecc6818cb9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9360 Malicious code in down-load-available-zip-now-23630-non-stop-je-te-plie-en-deux-6jxm0-xjqkwj (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 382006e2345d556d86f24dd65c61ef384292eebd06018746c90fcb445fb9f06e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9362 Malicious code in down-load-available-zip-now-365509-chew-the-scenery-ymqd7-xaqqmu (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39470e2ad654687e0841bb2740b376632c07ad817ddd755c4037149fb3872220 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9354 Malicious code in down-lo-ad-now-zip-mp3-61269-billy-mann-9mfek-wlvmjv (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f1e91485877216aa978237d462f08009f418e00a915794963346cc39cb14f264 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9345 Malicious code in availab-le-alb-um-zip-26387-this-is-the-second-album-of-a-band-called-adebisi-shank-pdmrd-ikxtvt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49e49a7981d176acea58956a8041e33887f222b2775dc802bf49a49e1a733998 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9350 Malicious code in do-wnload-available-67250-from-gardens-where-we-feel-secure-1-zuhte-cbguim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c9c3c1317e100639f80a2fa6bf8ef45f57844ec4d66cb968b6f04306fed84ebf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Privilege Escalation

Tgithub.com/talos-systems/talos is vulnerable to Privilege Escalation. The vulnerability is due to improper validation of the requests during the certificate signing process for worker nodes in the Talos cluster. It allows a control plane node to issue Talos API certificates that grant unauthoriz...

Malicious code in module-grab (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb37f88f9f6a37fa239ee1d591acdd1ee642b1d6447cba12accde00c474a94bb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9157 Malicious code in knu2bb (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 244d62f88aebd6b02796516f10f0cb8eba074b905b90a8c3cb938789c12c04f1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9167 Malicious code in new-code-script-down-lo-ad-jjsploit-roblox-executor-fi7j8p (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0ba7e29bf181a9fc2806a8929c4fbd604f9ac9bf7d14d4b59b0fdd97918b3194 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9215 Malicious code in ads-api-report-fetcher (npm)

The package contains code to exfiltrate local machine information to a remote server over DNS. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57e20c733e3432bce50d7684946f0b982e3dd599d8a2df2689208afe1237c24d Any computer that has this package installed or running...

MAL-2024-9076 Malicious code in dsp_login_front (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7af276e10932b2793bd4d19b246087ea006054e2fa3f0cc1907fd11be997b747 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Express.js Express-Session Weak Secret Key

Express.js applications with Express-Session use an application key to encrypt and sign various data, including session cookies and other sensitive information. This key is typically stored in an environment variable and is used for multiple security-critical operations. When a weak or easily...