MAL-2025-40477 Malicious code in yeti-wave-wtx381-project (npm)

The package yeti-wave-wtx381-project was found to contain malicious code...

The vulnerability of the YETI platform for collecting and analyzing data on cyber threats lies in the insufficient verification of input data. This allows a malicious actor to execute arbitrary code or carry out Server Side Template Injection (SSTI) attacks.

The vulnerability of the YETI platform for collecting and analyzing data on cyber threats is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code or carry out Server Side Template Injection SSTI attacks...

The vulnerability of the Yeti threat analysis platform, which relies on the use of strictly encrypted credentials, allows attackers to escalate their privileges.

The vulnerability of the Yeti threat analysis platform is related to the use of strictly encrypted credentials. Exploiting this vulnerability allows a remote attacker to enhance their privileges by using a static JWT token...

CVE-2024-46507: Yeti Platform Server-Side Template Injection (SSTI)

The post CVE-2024-46507: Yeti Platform Server-Side Template Injection SSTI appeared first on Rhino Security Labs...

PT-2024-10438

Name of the Vulnerable Software and Affected Versions Yeti platform affected versions not specified Description The issue is related to the use of hardcoded credentials. An attacker can exploit this to gain elevated privileges by utilizing a static JWT token. Recommendations At the moment, there ...

CVE-2024-45412

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial o...

CVE-2024-45412 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial o...

CVE-2024-45412 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial o...

CVE-2024-45412

The CVE-2024-45412 entry affects Yeti Platform versions prior to 2.1.11. The vulnerability arises from remote user-controlled data tags undergoing Unicode normalization with the NFKD form, which on Windows can be resource-intensive and lead to denial of service, potentially exacerbated by large p...

CVE-2024-45412 Yeti affected by a Potential Denial of Service due to the One Milion Unicode characters attack

Yeti bridges the gap between CTI and DFIR practitioners by providing a Forensics Intelligence platform and pipeline. Remote user-controlled data tags can reach a Unicode normalization with a compatibility form NFKD. Under Windows, such normalization is costly in resources and may lead to denial o...

Yeti Platform 安全漏洞

Yeti Platform is a daily threat intelligence platform open-sourced by Yeti Platform. A security vulnerability exists in Yeti Platform versions prior to 2.1.11, which stems from a denial-of-service attack in which remote user-controlled data tags can be Unicode normalized via the compatibility for...

faust.ch Cross Site Scripting vulnerability OBB-3848411

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

YetiForceCrm 跨站脚本漏洞

YetiForceCrm is an open source Crm system from the Polish company YetiForce. A cross-site scripting vulnerability exists in versions of YetiForceCrm prior to 6.4.0, which stems from a lack of effective filtering and escaping of user-supplied data and can be exploited by an attacker to cause a...

The vulnerability of YetiFroce CRM’s customer relationship management system, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the YetiFroce CRM system for managing customer relationships is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

The vulnerability of YetiFroce CRM’s customer relationship management system, related to the lack of measures taken to protect the website structure, allows attackers to carry out cross-site scripting attacks.

The vulnerability of the YetiFroce CRM system for managing customer relationships is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks remotely...

Wrong lastBuyBackPrice

Handle cmichel Vulnerability details The sYETIToken.lastBuyBackPrice is set in buyBack and hardcoded as: function buyBackaddress routerAddress, uint256 YUSDToSell, uint256 YETIOutMin, address memory path external onlyOwner requireYUSDToSell 0, "Zero amount"; requirelastBuybackTime + 69 hours...

Yeti token rebase checks the additional token amount incorrectly

Handle hyh Vulnerability details Impact The condition isn't checked now as the whole balance is used instead of the Yeti tokens bought back from the market. As it's not checked, the amount added to effectiveYetiTokenBalance during rebase can exceed the actual amount of the Yeti tokens owned by th...

sendAllocatedYETI() can be called by anyone

Handle jayjonah8 Vulnerability details Impact In TeamAllocation.sol, the sendAllocatedYETI function simply distributes YETI to the team. This is a transfer of value and it currently can be called by anyone as the onlyTeam modifier is not used here. Proof of Concept Tools Used Manual code review...

acceldata-o2a (=1.0.0), aleksis-builddeps (>=2021.12.0.post0 <=2022.6.1) +24 more potentially affected by CVE-2020-5252 via safety (>=0.3.0 <=1.8.7)

safety PYPI version =0.3.0, =2021.12.0.post0, =1.1.0, =0.9.0, =0.1.24, =2020.0.2, =0.0.0, =0.2.0.dev20170127093917, =0.1.0, =0.0.12, =0.0.1, =0.0.2 and more Source cves: CVE-2020-5252 Source advisory: OSV:GHSA-7Q25-QRJW-6FG2...

CVE-2019-20061

The user-introduction email in MFScripts YetiShare v3.5.2 through v4.5.4 may leak the system-picked password if this email is sent in cleartext. In other words, the user is not allowed to choose their own initial password...