Meta Takes Down Malware Campaign That Used ChatGPT as a Lure to Steal Accounts

Meta said it took steps to take down more than 1,000 malicious URLs from being shared across its services that were found to leverage OpenAI's ChatGPT as a lure to propagate about 10 malware families since March 2023. The development comes against the backdrop of fake ChatGPT web browser extensio...

Upgraded Q -> 2 from #854 [1683053416481]

Judge has assessed an item in Issue 854 as 2 risk. The relevant finding follows: L-07 Malicious collection owner could steal all base tokens by updating royalty during calls 1 --- The text was updated successfully, but these errors were encountered: All reactions...

GHSA-CJV6-W5HF-5WR6 Cross-site Scripting (XSS) in Ecommerce Pricing Rules name field

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.21 or apply this patch manually...

Criminals Are Using Tiny Devices to Hack and Steal Cars

Apple thwarts NSO’s spyware, the rise of a GPT-4 black market, Russia targets Starlink internet connections, and more...

Schneider Electric NetBotz Cross-Site Scripting Vulnerability

Schneider Electric NetBotz is a proactive monitoring solution from Schneider Electric, France. It is designed to protect against physical, environmental or human threats that can cause disruption or downtime to IT infrastructure. Schneider Electric NetBotz suffers from a cross-site scripting...

Cybercriminals Exploit CAN Injection Hack to Steal Cars

By Waqas If it is connected, it is vulnerable; in this case, a Toyota RAV4 model was stolen within two minutes. This is a post from HackRead.com Read the original post: Cybercriminals Exploit CAN Injection Hack to Steal Cars...

Attacker can steal the locked NFT in protocol because of lacking check in function borrowToBuy()

Lines of code Vulnerability details Impact In function borrowToBuy, the borrower takes a loan offer and uses the funds to purchase NFT. / Take the loan offer. / takeLoanOfferoffer, signature, lienId, loanAmount, collateralTokenId; / Lock token. / offer.collection.transferFrommsg.sender,...

GHSA-6QJM-39VH-729W Pimcore Cross-site Scripting in Predefined Asset Metadata module in Settings

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.20 or apply this patch manually...

And all this assembly shall know that the OWNER SafEth not with derivatives: for the derivative is the OWNER'S, and he will rebalanceToWeights it into his EOA.

Lines of code Vulnerability details Impact The owner of SafEth can at any time steal all staked funds. Proof of Concept SafEth.addDerivative allows the owner to add any derivative contract, such as one where he can withdraw all IDerivative.deposit-ed funds. SafEth.adjustWeights allows the owner t...

OneSignal命令注入漏洞

OneSignal is a push notification, email, and SMS application from OneSignal. OneSignal suffers from a command injection vulnerability. An attacker could use the vulnerability to take over GitHub Runner and run custom commands to steal sensitive information or make changes to the repository...

PT-2023-15307

Name of the Vulnerable Software and Affected Versions Tussendoor internet & marketing Open RDW kenteken voertuiginformatie plugin versions = 2.0.14 Description The issue is a Reflected Cross-Site Scripting XSS vulnerability. This means an attacker can inject malicious scripts into a website,...

Malicious member can steal funds from the DAO contract.

Lines of code Vulnerability details Impact The malicious member can steal assets from DAO protocol. Proof of Concept The protocol allows the member to have the voting power to create a proposal createProposal. Where the action struct in the parameter refers to be consumed by the DAO's execute...

Malicious owner can steal funds

Lines of code Vulnerability details Impact if the owner is malicious, he can drain all funds to his wallet Proof of Concept Tools Used manual review Recommended Mitigation Steps 1. Transfer funds to special trusted contract so funds can be locked and safe. 2. amount input value limit so there...

Malicious code in selfccpullint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx e806301e32059a79cc3b5f5fa653f7b757e11add5a0e77fcbb3168603ea96800 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in py-osintvisa (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2db1bcea977a14fa8429f47c3b448586736bcc30ac5d2789cc7059f2fd3194dc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

OpenNMS Meridian and Horizon vulnerable to Cross-site Scripting

Reflected cross-site scripting in graph results in multiple versions of OpenNMS Meridian and Horizon could allow an attacker access to steal session cookies...

K15875: cURL vulnerability CVE-2013-1944

Security Advisory Description The tailMatch function in cookie.c in cURL and libcurl before 7.30.0 does not properly match the path domain when sending cookies, which allows remote attackers to steal cookies via a matching suffix in the domain of a URL. CVE-2013-1944 Impact Allows unauthorized...

Malicious code in prize-market (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 1158c7ff397e59bc3ac71f973b0f8011d57ebb50ed376f780513195f5c97f596 Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

Malicious code in progressbaar2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2d09cee039cde38851d5665600988d687c5fef88589f21a51df757b9251c27d6 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in diiscord-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7e0cbb67d61a781be45742353ac7c013d21e8fdbae13544700dedd778b19a0d3 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...