MAL-2024-112 Malicious code in djs-selfbot-v14 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3afe9942efa3f5082e6e6393ab078295d7c051c7f113d3ff2ca4e44eb520d9ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Input validation

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

CVE-2023-49804 Uptime Kuma Password Change Vulnerability

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

CVE-2023-49804

Summary: CVE-2023-49804 affects Uptime Kuma and precedes version 1.23.9. When a user changes their login password, a previously logged-in user remains authenticated and can access the platform, an issue that persists across system/browser restarts. This vulnerability can expose sensitive data due...

CVE-2023-49804 Uptime Kuma Password Change Vulnerability

Uptime Kuma is an easy-to-use self-hosted monitoring tool. Prior to version 1.23.9, when a user changes their login password in Uptime Kuma, a previously logged-in user retains access without being logged out. This behavior persists consistently, even after system restarts or browser restarts. Th...

MAL-2023-8608 Malicious code in moonpig (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3bf064eedf0d80bc14ce31e1deee2fd824472437a9fa79fb15602d6b09c478d9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8606 Malicious code in todo-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4dc3036374d0687be9d2c3ce1a73b73181d87ad3e1a67d8368bb460150148c5e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Weak 2FA Code Generation

Fides is vulnerable to Weak Code Generation. The vulnerability is due to the usage of the python random module used for generating one time codes in the Privacy and Consent request process which is considered to be a cryptographically weak pseudo-random number generator. This issue allows an...

MAL-2023-8517 Malicious code in @airslate/front-locales (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e41b723776c055272b1cc4c219aba6cfae1a13b0ff87d90e8f0667b79d626e00 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8511 Malicious code in iproduce (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d9793afabdea98cc294df5335305541ec8d48c6f0fe655e511f82c46d2bd5685 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Denial Of Service (DoS)

squid is vulnerable to a Denial Of Service DoS. In this scenario, a remote attacker has the potential to execute a buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory. This occurs specifically when Squid is configured to accept HTTP Digest Authentication. Buffer overflow...

MAL-2023-8493 Malicious code in discord-oauth2.js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c230934619742d3d57fbc719cc2eff0dabd57a22c74405adcdf1e214fee0b91 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8497 Malicious code in vetx (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b626076d9322f28599d5e0ae9fca6df91d1c3f8a70e878019b56ff87fef7de48 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-4535

An out-of-bounds read vulnerability was found in OpenSC packages within the MyEID driver when handling symmetric key encryption. Exploiting this flaw requires an attacker to have physical access to the computer and a specially crafted USB device or smart card. This flaw allows the attacker to...

Medical research data Advarra stolen after SIM swap

Clinical research company Advarra has reportedly been compromised after a SIM swap on one of their executives. SIM swapping, also known as SIM jacking, is the act of illegally taking over a target’s cell phone number. This can be done in a number of ways, but one of the most common methods involv...

MAL-2023-8421 Malicious code in counterstake-bridge (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 914d424cbe1169a646b4168d95951a3b22819ba21697ff185656c69bd75c1512 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8407 Malicious code in hydradx-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0abec8f2cef143387e4657c22d48e41efac43c4f4d8c40ea5712f19d7d7f9270 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8376 Malicious code in @momo-miniapp/api (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6007d4e44cc4c068a9bb068cda01c272f184a9023da891b3f63737a50f814575 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8316 Malicious code in mtsinai-staging (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d8b8ce7354368bf548718481b77212b259ca68d7873bf856ab952feff9e5b79 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8294 Malicious code in f0-normalizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59555a81498457e7dd566cb779db13702f1f1672fc7755c89cbb11a6c2d898b4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...