CVE-2021-28665

Stormshield SNS with versions before 3.7.18, 3.11.6 and 4.1.6 has a memory-management defect in the SNMP plugin that can lead to excessive consumption of memory and CPU resources, and possibly a denial of service...

CVE-2020-11711

An issue was discovered in Stormshield SNS 3.8.0. Authenticated Stored XSS in the admin login panel leads to SSL VPN credential theft. A malicious disclaimer file can be uploaded from the admin panel. The resulting file is rendered on the authentication interface of the admin panel. It is possibl...

CVE-2019-1003063

Jenkins Amazon SNS Build Notifier Plugin stores credentials unencrypted in its global configuration file on the Jenkins master where they can be viewed by users with access to the master file system...

MAL-2024-12040 Malicious code in slack-sns (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dde2984debaba750af691ea1ba70116984fba098ecf0fe26a0fdf576d386f53a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in slack-sns (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dde2984debaba750af691ea1ba70116984fba098ecf0fe26a0fdf576d386f53a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-9555 Malicious code in client-sns (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in client-sns (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-7844 Malicious code in lambda-sns-dynatrace-sdk (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6846e2cf86562a1515400ba129d4fef5beb818c3002079e8bdd09c9e86f00fc5 Any computer that has this package install...

CVE-2024-37386

An issue was discovered in Stormshield Network Security SNS 4.0.0 through 4.3.25, 4.4.0 through 4.7.5, and 4.8.0. Certain manipulations allow restarting in single-user mode despite the activation of secure boot. The following versions fix this: 4.3.27, 4.7.6, and 4.8.2...

CVE-2024-31946

An issue was discovered in Stormshield Network Security SNS 3.7.0 through 3.7.41, 3.10.0 through 3.11.29, 4.0 through 4.3.24, and 4.4.0 through 4.7.4. A user who has access to the SNS with write access on the email alerts page has the ability to create alert email containing malicious JavaScript,...

CVE-2024-31946

CVE-2024-31946 affects Stormshield Network Security (SNS). A user with write access to the SNS email alerts page can craft an alert email containing malicious JavaScript that is executed in the template preview. Affected versions include 3.7.0–3.7.41, 3.10.0–3.11.29, 4.0–4.3.24, and 4.4.0–4.7.4. ...

CVE-2024-37386

Stormshield Network Security (SNS) has a vulnerability affecting versions 4.0.0–4.3.25, 4.4.0–4.7.5, and 4.8.0 that permits restarting in single-user mode despite Secure Boot being active. The issue arises from certain manipulations that bypass the secure boot protection. Remediation is provided ...

CVE-2024-31946

An issue was discovered in Stormshield Network Security SNS 3.7.0 through 3.7.41, 3.10.0 through 3.11.29, 4.0 through 4.3.24, and 4.4.0 through 4.7.4. A user who has access to the SNS with write access on the email alerts page has the ability to create alert email containing malicious JavaScript,...

MAL-2024-6737 Malicious code in aws-sns_subscription (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in alerty-plugin-amazon-sns (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-6550 Malicious code in alerty-plugin-amazon-sns (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Design/Logic Flaw

An issue was discovered in Stormshield Network Security SNS 3.7.0 through 3.7.38 before 3.7.39, 3.10.0 through 3.11.26 before 3.11.27, 4.0 through 4.3.21 before 4.3.22, and 4.4.0 through 4.6.8 before 4.6.9. An administrator with write access to the SNS firewall can configure a login disclaimer wi...

CVE-2023-34198

In Stormshield Network Security SNS 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot...

Improper access control

In Stormshield Network Security SNS 1.0.0 through 3.7.36 before 3.7.37, 3.8.0 through 3.11.24 before 3.11.25, 4.0.0 through 4.3.18 before 4.3.19, 4.4.0 through 4.6.5 before 4.6.6, and 4.7.0 before 4.7.1, the usage of a Network object created from an inactive DHCP interface in the filtering slot...

Malicious 'SNS Sender' Script Abuses AWS for Bulk Smishing Attacks

A malicious Python script known as SNS Sender is being advertised as a way for threat actors to send bulk smishing messages by abusing Amazon Web Services AWS Simple Notification Service SNS. The SMS phishing messages are designed to propagate malicious links that are designed to capture victims'...