Vulnerabilitycritical
Over 110,000 Websites Affected by Hijacked Polyfill Supply Chain Attack
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-2961 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the… | 7.3 | 88% | ||
| CVE-2024-34102 | XXE vulnerability enabling RCE in Adobe Commerce and Magento Open Source | 9.8 | 100% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | polyfill.com | eap, although it has since migrated to another domain named polyfill[.]com, according to developer security platform Socket. "We fou |
| domain | polyfill.io | ding "no website today requires any of the polyfills in the polyfill[.]io library" and that "most features added to the web platfor |
From the original article
4 min read at thehackernews.com
Google has taken steps to block ads for e-commerce sites that use the Polyfill. io service after a Chinese company acquired the domain and modified the JavaScript library ("polyfill. js") to redirect users to malicious and scam sites.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.