Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

CIRCL OSINT Feed

Threatpost

ThreatFox MISP Feed

Bleeping Computer

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

quasar

Quasar version 2.20.1 and earlier are vulnerable to prototype pollution via the public extend() utility. The vulnerability occurs during deep merge operations where attacker-controlled keys such as __proto__, constructor, or prototype are not blocked, allowing modification of Object.prototype. This can lead to application-specific impacts such as logic bypass or denial of service if polluted properties are used unsafely.

The Quasar package (npm) exports an extend() utility that performs deep merging of objects. In versions prior to 2.22.0, when extend(true, target, source) is called, the function recursively copies keys from the source to the target without filtering out prototype-pollution primitives like __proto__, constructor, or prototype. This allows an attacker to inject properties into Object.prototype, affecting all objects in the JavaScript environment. The vulnerability is demonstrated by a proof-of-concept where extend() is used to add a 'polluted' property to Object.prototype, which then appears on all objects. The suggested fix is to reject or ignore dangerous keys and avoid descending into prototype-related properties during the merge.

Detailed information about Quasar: Prototype pollution in the extend() utility affecting null quasar. Get real-time updates, technical details, and mitigation s

Quasar: Prototype pollution in the extend() utility - Live Threat Intelligence - Threat Radar | OffSeq.com

Quasar: Prototype pollution in the extend() utility

Threats Tagged 'ghsa-3r53-75j5-3g7j'