CVE-2022-40429

The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-networking package. The affected version is 0.1.0...

CVE-2022-40810

The d8s-ip-addresses for python, as distributed on PyPI, included a potential code-execution backdoor inserted by a third party. The backdoor is the democritus-hypothesis package. The affected version is 0.1.0...

PT-2022-37370 · Pypi · Democritus-Hypothesis +1

Name of the Vulnerable Software and Affected Versions: d8s-ip-addresses version 0.1.0 Description: The d8s-ip-addresses package for python, distributed on PyPI, contains a potential code-execution backdoor. This backdoor is inserted by a third party through the democritus-hypothesis package...

Democritus Project 安全漏洞

Democritus Project is a collection of simple, effective, modular, fully tested and well-documented features from Democritus, Inc. A security vulnerability exists in Democritus Project d8s-ip-addresses version 0.1.0 that originates from a potential code execution backdoor inserted by a third party...

Democritus Project 安全漏洞

Democritus Project is a collection of simple, effective, modular, fully tested and well-documented features from Democritus, Inc. A security vulnerability exists in Democritus Project d8s-ip-addresses version 0.1.0 that originates from a potential code execution backdoor inserted by a third party...

PT-2022-25378 · Pypi · Democritus-Networking +1

Name of the Vulnerable Software and Affected Versions: d8s-ip-addresses version 0.1.0 Description: The d8s-ip-addresses package for Python, distributed on PyPI, contains a potential code-execution backdoor. This backdoor is attributed to the democritus-networking package, which was inserted by a...

CVE-2022-40769

profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from Ethereum vanity addresses and steal cryptocurrency, as exploited in the wild in June 2022...

VulnCheck KEV: CVE-2022-40769

profanity through 1.60 has only four billion possible RNG initializations. Thus, attackers can recover private keys from Ethereum vanity addresses and steal cryptocurrency, as exploited in the wild in June 2022...

PT-2022-25527

Name of the Vulnerable Software and Affected Versions profanity versions 1.60 and earlier Description The issue allows attackers to recover private keys from Ethereum vanity addresses and steal cryptocurrency due to only four billion possible RNG initializations. This has been exploited in the...

Exploit for Use After Free in Microsoft

Bluekeep-Hunter CVE-2019-0708 This uses metasploit module in...

Craft CMS Stored Cross-site Scripting in User Addresses Title

Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting XSS in /admin/myaccount...

GHSA-8R89-X93X-MJQ2 Craft CMS Stored Cross-site Scripting in User Addresses Title

Craft CMS 4.2.0.1 suffers from Stored Cross Site Scripting XSS in /admin/myaccount...

Akamai Mitigated Record-Breaking DDoS Attack Against European Customer

By Waqas Threat actors managed to target more than 1,800 IP addresses of a single organization, and the DDoS attack was dispersed at six different locations. This is a post from HackRead.com Read the original post: Akamai Mitigated Record-Breaking DDoS Attack Against European Customer...

CVE-2022-31735

OpenAM Consortium Edition version 14.0.0 provided by OpenAM Consortium contains an open redirect vulnerability CWE-601. When accessing an affected server through some specially crafted URL, the user may be redirected to an arbitrary website...

FBI Seizes Stolen Cryptocurrencies

The Wall Street Journal is reporting that the FBI has recovered over $30 million in cryptocurrency stolen by North Korean hackers earlier this year. Its only a fraction of the $540 million stolen, but its something. The Axie Infinity recovery represents a shift in law enforcements ability to trac...

nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets

A flaw was found in the got package for node.js. Requested URLs are not verified and allow open redirection to a local UNIX socket...

CVE-2022-35572

On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, and potentially other vendors/devices due to code reuse, the /SysInfo.htm URI does not require a session ID. This web page calls a showsysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS...

CVE-2022-35572

On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, and potentially other vendors/devices due to code reuse, the /SysInfo.htm URI does not require a session ID. This web page calls a showsysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS...

CVE-2022-35572

On Linksys E5350 WiFi Router with firmware version 1.0.00.037 and lower, and potentially other vendors/devices due to code reuse, the /SysInfo.htm URI does not require a session ID. This web page calls a showsysinfo function which retrieves WPA passwords, SSIDs, MAC Addresses, serial numbers, WPS...

PT-2022-23181 · Xwiki · Xwiki-Platform-Web-Templates

Name of the Vulnerable Software and Affected Versions: XWiki Platform Web Templates versions prior to 13.10.4 and 14.2 Description: The issue allows access to string and list properties of objects that the user should not have access to, including private personal information like email addresses...