CrowdStrike Falcon LogScaleに認証不要で任意ファイルの閲覧が可能な脆弱性が見つかった。CVSSの評価は9.8、深刻度「緊急」に該当する。SaaSは対策済みで被害確認なし、自社運用版は更新が必要だ。

Find any country or US state in the live-updating and cus...

Research on the function and evolution of animal sounds typically analyses sound frequency on a linear scale (Hz), despite the perception and modulation of sound frequency by animals being better ...

🚨 CrowdStrike has had its NPM packages compromised 𝘔𝘺 𝘣𝘪𝘨 '𝘏𝘈𝘊𝘒𝘌𝘋' 𝘴𝘵𝘢𝘮𝘱 𝘪𝘴 𝘣𝘢𝘤𝘬.  Crowdstrike has been caught in a Supply chain attack that so far includes 180 packages from various organizations. 𝗖𝗿𝗼𝘄𝗱𝘀𝘁𝗿𝗶𝗸𝗲 𝗽𝗮𝗰𝗸𝗮𝗴𝗲𝘀 𝗰𝗼𝗺𝗽𝗿𝗼𝗺𝗶𝘀𝗲𝗱 𝗶𝗻𝗰𝗹𝘂𝗱𝗲  @crowdstrike/commitlint @crowdstrike/falcon-shoelace @crowdstrike/foundry-js @crowdstrike/glide-core @crowdstrike/logscale-dashboard @crowdstrike/logscale-file-editor @crowdstrike/logscale-parser-edit @crowdstrike/logscale-search @crowdstrike/tailwind-toucan-base This appears to be a continuation of the Tinycolor attack first discovered by Daniel Pereira that Socket and StepSecurity had reported on. Both discovered that a combined 40 packages were compromised. Since then, an additional 140 packages have been compromised, including those from Crowdstrike. This is ongoing, so expect more compromises to follow. 𝗪𝗵𝗮𝘁 𝘁𝗵𝗲 𝗺𝗮𝗹𝘄𝗮𝗿𝗲 𝗱𝗼𝗲𝘀  The malware steals credentials using webhook[.]site, this is especially bad because they are using a free-tier webho