Latest News

#### Description In minio-java versions prior to 8.6.0, XML tag values containing references to system properties or environment variables were automatically substituted with their actual values during processing. This unintended behavior could lead to the exposure of sensitive information, including credentials, file paths, or system configuration details, if such references were present in XML content from untrusted sources. #### Affected Versions - minio-java < 8.6.0 All applications utilizing affected versions of minio-java for parsing XML with potentially untrusted input are vulnerable. #### Impact This vulnerability poses a high risk of information disclosure. Attackers could craft malicious XML inputs to extract sensitive data from the system's properties or environment variables, potentially compromising security in applications relying on minio-java for object storage operations. #### Patches The issue is resolved in minio-java version 8.6.0 and later. In these versions, a...

### Summary There are three potential attacks of arbitrary code injection vulnerability in the composite action at _action.yml_. ### Details The GitHub Action variables `inputs.prek-version`, `inputs.extra_args`, and `inputs.extra-args` can be used to execute arbitrary code in the context of the action. ### PoC ```yaml - uses: j178/prek-action@v1.0.5 with: prek-version: $(printenv >> $GITHUB_STEP_SUMMARY && echo "0.2.2") extra_args: '&& echo "MY_SECRET with a character is: ${MY_SECRET:0:1}a${MY_SECRET:1}" >> $GITHUB_STEP_SUMMARY && echo ""' env: MY_SECRET: ${{ secrets.MY_SECRET }} ``` The previous example will print all the environment variables, and it will expose `MY_SECRET` environment variable value to the summary of the workflow. An attacker could potentially use this vector to compromise the security of the target repository, even passing unnotice because the action will run normally. ### Impact Critical, CWE-94

Dutch authorities arrest two teens recruited by pro-Russian hackers for spying missions. Learn how Russia is using disposable agents for sabotage across Europe.

Threat actors have been observed using seemingly legitimate artificial intelligence (AI) tools and software to sneakily slip malware for future attacks on organizations worldwide. According to Trend Micro, the campaign is using productivity or AI-enhanced tools to deliver malware targeting various regions, including Europe, the Americas, and the Asia, Middle East, and Africa (AMEA) region.

### Impact CWE-20: Improper Input Validation Low impact ### Patches Patched in v7.1.8 (commit https://github.com/mondeja/mkdocs-include-markdown-plugin/commit/7466d67aa0de8ffbc427204ad2475fed07678915) ### Workarounds No

### Impact Due to incorrect handling of the `mail.Address` values when a sender- or recipient address is passed to the corresponding `MAIL FROM` or `RCPT TO` commands of the SMTP client, this could lead to a possible wrong address routing or even to ESMTP parameter smuggling. #### Vulnerability details Instead of making use of the `String()` method of `mail.Address`, which takes care of proper escaping and quotation of mail address, we used the `Address` value of the `mail.Address` which is the raw value when passing it to our SMTP client. This meant, if a mail address like this was set: `"toni.tester@example.com> ORCPT=admin@admin.com"@example.com` for a sender or recipient, instead of the correctly quoted/escaped address, the SMTP client would get the raw value passed which would translate into something like this being passed to the SMTP server: `RCPT TO:<toni.tester@example.com> ORCPT=admin@admin.com@example.com>`. Since ORCTP is a valid command for the SMTP server, the mail wo...

SafeDep `vet` is vulnerable to a DNS rebinding attack due to lack of HTTP `Host` and `Origin` header validation. To exploit this vulnerability following conditions must be met: 1. A `vet` scan is executed and reports are saved as `sqlite3` database 2. A `vet` MCP server is running on default port with SSE transport that has access to the report database 3. The attacker lures the victim to attacker controlled website 4. Attacker leverages DNS rebinding to access `vet` SSE server on `127.0.0.1` through the website 5. Attacker uses MCP tools to read information from report database ### Impact Data from `vet` scan sqlite3 database may be exposed to remote attackers when `vet` is used as an MCP server in SSE mode with default ports through the sqlite3 query MCP tool. ### Patches * `v1.12.5` is released that patches the issue with `Host` and `Origin` header allow list and validation ### Workarounds * Use `stdio` (default) transport for SSE server

Luxury retailer Harrods confirms 430,000 customer records (names, contacts) were stolen from a third-party provider in the latest UK retail cyberattack wave.

Amazon settled a $2.5 billion lawsuit for tricking users into buying Prime subscriptions which were hard to cancel.

Attackers impersonate the National Police of Ukraine to deploy Amatera Stealer and PureMiner, using malicious Scalable Vector Graphics to trick victims.