45 matches found
bt2
bt2: Herramientas de Puerta Trasera de Telegram Blaze bt2 es una puerta trasera basada en Python en forma de un bot de mensajería instantánea que utiliza la infraestructura y la API de bot rica en funciones proporcionada por Telegram, reutilizando ligeramente su plataforma de comunicación para...
RAT-via-Telegram
RAT-por-Telegram Notas de Dviros: Herramienta de Post-Intrusión Remota para Windows vía Telegram Python 2.7, Creada originalmente por Ritiek, bifurcada y modificada por mvrozanti y luego por mí mismo. El propósito principal de esta herramienta es demostrar como una "PoC" el control de una máquina...
RAT-via-Telegram
RAT-vía-Telegram Herramienta de Administración Remota de Windows vía Telegram ¡ahora en Python 3.7! | Creada originalmente por Ritiek ¿Por qué otra? Las herramientas de administración remota actuales en el mercado enfrentan 2 problemas principales: Falta de cifrado. Requieren redireccionamiento d...
CVE-2026-101050
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
EUVD-2026-87970
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
CVE-2026-101050 Heym before 0.0.53 Authentication Bypass via Telegram Webhook
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
CVE-2026-101050: Improper Authentication
Heym before 0.0.53 fails to verify the X-Telegram-Bot-Api-Secret-Token header on Telegram webhook endpoints when credentialid is absent or secrettoken is empty. Remote unauthenticated attackers can post forged Telegram updates to trigger workflows with the owner's configured credentials and execu...
Malicious code in discord-resolvers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...
MAL-2026-16214 Malicious code in discord-resolvers (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6aa01ed90340a9458c2906ec74fd9277bb7d0e4da48ef09487639aa6c45e6791 The package published as discord-resolvers is unrelated to Discord. On require, index.js invokes startBackupLoop at top level, which recursively...
Malicious code in dotish (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d2ccb1a1f0c28d673323f0377c9e65232611641c9de3dbb97f92b17779660b20 The package's postinstall lifecycle script auto-runs on npm install and reads the installer's current working directory .env file typically containin...
MAL-2026-13258 Malicious code in bitcoinjs-wallet (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8981a1bdc42ac6f595b3805c959060201fc4eb0c39b5bf50b25c5d3d7cc398b5 [email protected] is a typosquat of bitcoinjs-lib that performs credential theft at module load. On require, index.js collects hostname, usernam...
MAL-2026-6446 Malicious code in base62-86x (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 811002816e7f72588c7c6540b088af5c44b8280574e43dbaeef4701fe377fe9f Package impersonates the legitimate base-x/base62 library by Daniel Cousens name base62-86x, homepage pointing at cryptocoinjs/base-x, identical sour...
CVE-2026-7701
Telegram Desktop
CVE-2026-7701 Telegram Desktop Bot API url_auth_box.cpp RequestButton null pointer dereference
A security vulnerability has been detected in Telegram Desktop up to 6.7.5. This vulnerability affects the function RequestButton of the file Telegram/SourceFiles/boxes/urlauthbox.cpp of the component Bot API. The manipulation of the argument loginurl leads to null pointer dereference. It is...
EUVD-2025-37255
Malicious code in custom-telegram-bot-api npm...
MAL-2025-49255 Malicious code in custom-telegram-bot-api (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector efed332de627322e3b4c8adc27a889238eb809493e86244e15d96e7b6e45dd87 The package custom-telegram-bot-api was found to contain malicious code. Source: ghsa-malware...
Malicious Package
Overview custom-telegram-bot-api is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packa...