Security
Headlines
HeadlinesLatestCVEs

Latest News

GHSA-53gx-j3p6-2rw9: XWiki Jetty Package (XJetty) allows accessing any application file through URL

### Impact In an instance which is using the XWiki Jetty package (XJetty), a context is exposed to statically access any file located in the webapp/ folder. It allows accessing files which might contains credentials, like http://myhots/webapps/xwiki/WEB-INF/xwiki.cfg, http://myhots/webapps/xwiki/WEB-INF/xwiki.properties or http://myhots/webapps/xwiki/WEB-INF/hibernate.cfg.xml. ### Patches This has been patched in 16.10.11, 17.4.4, 17.7.0. ### Workarounds The workaround is to modify the start_xwiki.sh script following https://github.com/xwiki/xwiki-platform/compare/8b68d8a70b43f25391b3ee48477d7eb71b95cf4b...99a04a0e2143583f5154a43e02174155da7e8e10. ### For more information If you have any questions or comments about this advisory: * Open an issue in [Jira XWiki.org](https://jira.xwiki.org/) * Email us at [Security Mailing List](mailto:security@xwiki.org) ### Attribution Vulnerability reported by Joseph Huber.

ghsa
#vulnerability#web#git#auth#jira
GHSA-pj86-cfqh-vqx6: express improperly controls modification of query properties

### Impact when using the extended query parser in express (`'query parser': 'extended'`), the `request.query` object inherits all object prototype properties, but these properties can be overwritten by query string parameter keys that match the property names > [!IMPORTANT] > the extended query parser is the default in express 4; this was changed in express 5 which by default uses the simple query parser ### Patches the issue has been patched to ensure `request.query` is a plain object so `request.query` no longer has object prototype properties. this brings the default behavior of extended query parsing in line with express's default simple query parser ### Workaround this only impacts users using extended query parsing (`'query parser': 'extended'`), which is the default in express 4, but not express 5. all users are encouraged to upgrade to the patched versions, but can otherwise work around this issue: #### provide `qs` directly and specify `plainObjects: true` ```js ap...

Coupang Data Breach Affects All 33.7 Million South Korean Accounts

Coupang confirms a data breach affecting 33.7 million users in South Korea, exposing names, contacts and order details. Investigation is ongoing.

India Orders Phone Makers to Pre-Install Sanchar Saathi App to Tackle Telecom Fraud

India's telecommunications ministry has reportedly asked major mobile device manufacturers to preload a government-backed cybersecurity app named Sanchar Saathi on all new phones within 90 days. According to a report from Reuters, the app cannot be deleted or disabled from users' devices. Sanchar Saathi, available on the web and via mobile apps for Android and iOS, allows users to report

ShadyPanda Turns Popular Browser Extensions with 4.3 Million Installs Into Spyware

A threat actor known as ShadyPanda has been linked to a seven-year-long browser extension campaign that has amassed over 4.3 million installations over time. Five of these extensions started off as legitimate programs before malicious changes were introduced in mid-2024, according to a report from Koi Security, attracting 300,000 installs. These extensions have since been taken down. "These

Police Seize Cryptomixer Domains, Infrastructure and 28M Dollars in Bitcoin

Swiss and German police shut down Cryptomixer, seizing servers, domains and 28M dollars in Bitcoin during an Europol backed action targeting crypto laundering.

New Android malware lets criminals control your phone and drain your bank account

Albiriox now targets over 400 financial apps and lets criminals operate your phone almost exactly as if it were in their hands.

What a Secure Setup Really Looks Like for Storing Digital Assets

How you choose to store your assets is one of the most important decisions you’ll make when you…

Malwarebytes joins Global Anti-Scam Alliance (GASA) as supporting member 

Scams are sneakier, more direct, and harder to spot than ever, so we're proud to work with GASA to help keep people safer online.

Flock Uses Overseas Gig Workers to Build Its Surveillance AI

An accidental leak revealed that Flock, which has cameras in thousands of US communities, is using workers in the Philippines to review and classify footage.