Microsoft Signing Key Stolen by Chinese

A bunch of networks, including US Government networks, have been hacked by the Chinese. The hackers used forged authentication tokens to access user email, using a stolen Microsoft Azure account consumer signing key. Congress wants answers. The phrase "negligent security practices" is being tosse...

CVE-2023-38497

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local...

CVE-2023-38497 Cargo not respecting umask when extracting crate archives

Cargo downloads the Rust project’s dependencies and compiles the project. Cargo prior to version 0.72.2, bundled with Rust prior to version 1.71.1, did not respect the umask when extracting crate archives on UNIX-like systems. If the user downloaded a crate containing files writeable by any local...

WordPress Forminator 1.24.6 Shell Upload

Exploit Title: WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution Date: 2023-07-20 Exploit Author: Mehmet Kelepçe Vendor Homepage: https://wpmudev.com/project/forminator-pro/ Software Link: https://wordpress.org/plugins/forminator/ Version: 1.24.6 Tested on: PHP - Mysql...

MAL-2023-1056 Malicious code in binarium-crm (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 0319a4b526e85c3f33642aef37de9fb6a431f79dc995b4829c1bf12b854d8721 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

WordPress Forminator 1.24.6 Plugin - Unauthenticated Remote Command Execution Vulnerability

Exploit Title: WordPress Plugin Forminator 1.24.6 - Unauthenticated Remote Command Execution Exploit Author: Mehmet Kelepçe Vendor Homepage: https://wpmudev.com/project/forminator-pro/ Software Link: https://wordpress.org/plugins/forminator/ Version: 1.24.6 Tested on: PHP - Mysql - Apache2 -...

Malicious code in binarium-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e6203f8ba86eed8c7eef3531a2e69f72fa4badbcd98e90b291436bf574cb24c7 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

FreeBSD-SA-23:08.ssh

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:08.ssh Security Advisory The FreeBSD Project Topic: Potential remote code execution via ssh-agent forwarding Category: contrib Module: OpenSSH Announced:...

FreeBSD-SA-23:09.pam_krb5

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 ============================================================================= FreeBSD-SA-23:09.pamkrb5 Security Advisory The FreeBSD Project Topic: Network authentication attack via pamkrb5 Category: core Module: pamkrb5 Announced: 2023-08-01...

MAL-2023-8013 Malicious code in binarium-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e6203f8ba86eed8c7eef3531a2e69f72fa4badbcd98e90b291436bf574cb24c7 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in awell-libs (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f22989168c34b37227bb7bcfe0b03c27cd141f8ec26d34a78a0c0ba06553f881 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test521 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 166bebecf34acabc1fdf3c66906bda21b7b7e7043f76cf728dd8637270162021 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test523 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a102fc358a2f397cc33b778fdc8edcca752c4a93e273f3e728d9e936ef75cbff Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test525 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 801d93e817d2a88be92c4ce8b23fb15ec2a02dba59eea3666d03eee45d2dd072 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test529 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 6f73644ba1b18278f2efd5eded48ae6a21c8477dc4c6e8120676bdb356438687 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test531 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ba34269365aec86c0211ee348c1cc4f84e68214a7aed51304d8a309857881001 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

Malicious code in developer_backup_test532 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f05f5aa40e4c7abb13accb6085899f4b3fdf227cad5d43b4066b5a7d73717243 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2023-8025 Malicious code in developer_backup_test532 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f05f5aa40e4c7abb13accb6085899f4b3fdf227cad5d43b4066b5a7d73717243 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2023-8016 Malicious code in developer_backup_test521 (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 166bebecf34acabc1fdf3c66906bda21b7b7e7043f76cf728dd8637270162021 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...

MAL-2023-8007 Malicious code in @rocketrefer/admin-panel (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx cee4d7f564848bd4bb2a8a410f60f22ce1bce642072b14a97281130483c8c1a9 Malicious packages campaign since 2021 targeting developers, steals source code and secrets...