Cross Site Scripting (XSS)

Algeron is vulnerable to Cross Site Scripting. The vulnerability is due to a lack of url data sanitization in the RegisterHandlers function of handlers.go, which can result in cookie stealing or redirection to an attacker controlled site...

Expert Restaurant eCommerce 1.0 Cross Site Scripting

┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...

The distribution logic will be broken after calling rageQuit()

Lines of code Vulnerability details Impact Malicious users might receive more distributed funds than they should with higher distributionShare. Proof of Concept In PartyGovernanceNFT.sol, there is a getDistributionShareOf function to calculate the distribution share of party NFT. function...

Malicious code in cxfreezepy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 98b9fe0f574ed33e0a4096ba8774936c73969493c1621244334a739ef4f94f5d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2692 Malicious code in cxfreezepy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 98b9fe0f574ed33e0a4096ba8774936c73969493c1621244334a739ef4f94f5d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Citadel 安全漏洞

Citadel is an asset management software from Citadel, Inc. in the United States. A security vulnerability exists in Citadel webcit 932, which originates from a vulnerability that allows an attacker to store a victim's email message in the attacker's IMAP mailbox, which can be exploited by an...

New Info Stealer Bandit Stealer Targets Browsers, Wallets

This is an analysis of Bandit Stealer, a new Go-based information-stealing malware capable of evading detection as it targets multiple browsers and cryptocurrency wallets...

Malicious code in oculoushide (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9b7403cc73bb98e45396c93de766686608f4d7f80a03e6e8af73d244de0c7fe1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4800 Malicious code in oculoushide (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 9b7403cc73bb98e45396c93de766686608f4d7f80a03e6e8af73d244de0c7fe1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Alert: Brazilian Hackers Targeting Users of Over 30 Portuguese Banks

A Brazilian threat actor is targeting more than 30 Portuguese financial institutions with information-stealing malware as part of a long-running campaign that commenced in 2021. "The attackers can steal credentials and exfiltrate users' data and personal information, which can be leveraged for...

Data Stealing Malware Discovered in Popular Android Screen Recorder App

Google has removed a screen recording app named "iRecorder - Screen Recorder" from the Play Store after it was found to sneak in information stealing capabilities nearly a year after the app was published as an innocuous app. The app APK package name "com.tsoft.app.iscreenrecorder", which accrued...

Debian: Security Advisory (DLA-3423-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

wxETH is vulnerable to the inflation attack

Lines of code Vulnerability details wxETH is vulnerable to the inflation attack The wxETH contract is vulnerable to the attack known as "inflation attack" in which a bad actor can front-run initial stake transactions and steal all deposit funds. Impact The staking functionality of wxETH is...

Inflation attack by token transfer

Lines of code Vulnerability details Impact The first staker can inflate the exchange rate by transferring tokens directly to the contract such that subsequent stakers get minted zero wxETH. Their stake can then be unstaked by the first staker, together with their own first stake and inflation...

GHSA-MHPJ-7M7H-8P6X Pimcore Cross-site Scripting (XSS) in Static Routes name field

Impact This vulnerability has the potential to steal a user's cookie and gain unauthorized access to that user's account through the stolen cookie or redirect users to other malicious sites. Patches Update to version 10.5.21 or apply this patch manually:...

MAL-2023-2474 Malicious code in discord-spammer-webhooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 992e658db3addbbf4402e9f8bfb5c3a8af81b96c87e70863df390190f52de66b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6525 Malicious code in selfpyintpaypal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 13bec999a49bf9dee37e242115164d05756af19ea57d26d0b54b4c67c1f01571 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in selfcontrolloadload (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 91681b7a493590b12a07e21ace57fdd2de85ae9dc23ca4f31d3b60c6a8ec1b9d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5975 Malicious code in selfcontrolloadload (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 91681b7a493590b12a07e21ace57fdd2de85ae9dc23ca4f31d3b60c6a8ec1b9d EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5233 Malicious code in py-intellibint (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx c51243b24c705c8e86f895cf56a4aaf31db49b64674882dbef77513f1bc075dc EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...