CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
Description: The zero-day (CVE-2024-49138), plus a worryingly critical unauthenticated RCE security vulnerability (CVE-2024-49112), are unwanted gifts for security admins this season.
December 10th, 2024 (6 months ago)
|
|
|
Description: There is a possible Cross Site Scripting (XSS) vulnerability in the content_security_policy helper in Action Pack.
Impact
Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks.
Releases
The fixed releases are available at the normal locations.
Workarounds
Applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Credits
Thanks to ryotak for the report!
References
https://github.com/rails/rails/security/advisories/GHSA-vfm5-rmrh-j26v
https://github.com/advisories/GHSA-vfm5-rmrh-j26v
December 10th, 2024 (6 months ago)
|
|
|
Description: Cross-Site Request Forgery (CSRF) in Avenwu Whistle v.2.9.90 and before allows attackers to perform malicious API calls, resulting in the execution of arbitrary code on the victim's machine.
References
https://nvd.nist.gov/vuln/detail/CVE-2024-55500
https://github.com/avwo/whistle/commit/d1b8ca275dc4e453bd2efed392c0fd4b92f73cdf
https://www.sonarsource.com/blog/never-underestimate-csrf-why-origin-reflection-is-a-bad-idea
https://github.com/advisories/GHSA-gg6x-448q-pqqm
December 10th, 2024 (6 months ago)
|
|
|
Description: Summary
pnpm seems to mishandle overrides and global cache:
Overrides from one workspace leak into npm metadata saved in global cache
npm metadata from global cache affects other workspaces
installs by default don't revalidate the data (including on first lockfile generation)
This can make workspace A (even running with ignore-scripts=true) posion global cache and execute scripts in workspace B
Users generally expect ignore-scripts to be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it).
Here, that expectation is broken
Details
See PoC.
In it, overrides from a single run of A get leaked into e.g. ~/Library/Caches/pnpm/metadata/registry.npmjs.org/rimraf.json and persistently affect all other projects using the cache
PoC
Postinstall code used in PoC is benign and can be inspected in https://www.npmjs.com/package/ponyhooves?activeTab=code, it's just a console.log
Remove store and cache
On mac: rm -rf ~/Library/Caches/pnpm ~/Library/pnpm/store
This step is not required in general, but we'll be using a popular package for PoC that's likely cached
Create A/package.json:{
"name": "A",
"pnpm": { "overrides": { "rimraf>glob": "npm:ponyhooves@1" } },
"dependencies": { "rimraf": "6.0.1" }
}
Install it with pnpm i --ignore-scripts (the flag is not required, but the point of the demo is to show that it doesn't help)
Create B/package.json:{
"name": "B",
"dependencies": { "rimraf": "6.0.1" }
}
Insta...
December 10th, 2024 (6 months ago)
|
|
|
Description: U.S. Senator Ron Wyden of Oregon announced a new bill to secure the networks of American telecommunications companies breached by Salt Typhoon Chinese state hackers earlier this year. [...]
December 10th, 2024 (6 months ago)
|
|
|
Description: The threat actor group recently took credit for a similar attack on Blue Yonder that affected multiple organizations, including Starbucks.
December 10th, 2024 (6 months ago)
|
|
|
Description: A vulnerability was found in OIDC-Client. When using the RH SSO OIDC adapter with EAP 7.x or when using the elytron-oidc-client subsystem with EAP 8.x, authorization code injection attacks can occur, allowing an attacker to inject a stolen authorization code into the attacker's own session with the client with a victim's identity. This is usually done with a Man-in-the-Middle (MitM) or phishing attack.
References
https://nvd.nist.gov/vuln/detail/CVE-2024-12369
https://access.redhat.com/security/cve/CVE-2024-12369
https://bugzilla.redhat.com/show_bug.cgi?id=2331178
https://github.com/advisories/GHSA-4v5x-9m47-cqr2
December 10th, 2024 (6 months ago)
|
|
|
Description: Ivanti warned customers on Tuesday about a new maximum-severity authentication bypass vulnerability in its Cloud Services Appliance (CSA) solution. [...]
December 10th, 2024 (6 months ago)
|
CVE-2024-49138 |
Description: Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.
CVSS: LOW (0.0) EPSS Score: 0.05%
December 10th, 2024 (6 months ago)
|
|
|
Description: Microsoft has released the KB5048652 cumulative update for Windows 10 22H2, which contains six fixes, including a fix that prevented Windows 10 from activating when you change a device's motherboard. [...]
December 10th, 2024 (6 months ago)
|