Exploit for Improper Input Validation in Microsoft

CVE-2023-21554-PoC CVE-2023-21554 is a Windows MessageQueuin...

MAL-2023-1209 Malicious code in index-template-mets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 104f2ff9714322069aa6e619d7050de41349e85f4c3eaa04c4c25ba0e239e8a9 The OpenSSF Package Analysis project identified 'index-template-mets' @ 1.0.1 npm as malicious. It is considered malicious because: - The packag...

Malicious code in nightmaretestingpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6ecc46cf13068e4ebe6d534e65e7588e04bcafa5de43fa84a3b1ef4de5d79cad The OpenSSF Package Analysis project identified 'nightmaretestingpackage' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

kernel: tools/power turbostat: Fix file pointer leak

In the Linux kernel, the following vulnerability has been resolved: tools/power turbostat: Fix file pointer leak Currently if a fscanf fails then an early return leaks an open file pointer. Fix this by fclosing the file before the return. Detected using static analysis with cppcheck:...

The nature of cyberincidents in 2022

Kaspersky offers various services to organizations that have been targeted by cyberattackers, such as incident response, digital forensics, and malware analysis. In our annual incident response report, we share information about the attacks that we investigated during the reporting period. Data...

PT-2025-26111 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A potential buffer overflow issue has been identified in the Linux kernel, specifically in the ni set mc special registers function. The issue arises from the lack of bounds checking f...

MAL-2023-10 Malicious code in security-util-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2309de1524c064d7eba8b0c288762426955241d23e00eaaeca7766758ab9054e The OpenSSF Package Analysis project identified 'security-util-py' @ 0.0.6 pypi as malicious. It is considered malicious because: - The package...

CVE-2023-23448

Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid usernames via analysis of source code...

MAL-2023-1226 Malicious code in lexicalutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74435494f223aa6bbba50c2e8e746a27b089ed5df8eabcb948a7bab06cc57e74 The OpenSSF Package Analysis project identified 'lexicalutils' @ 99.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1427 Malicious code in i18n_sonder (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9f0c939067907bb4e3bd0d91530b128f2ffe8c595d619eaa3ab544891de51e2b The OpenSSF Package Analysis project identified 'i18nsonder' @ 4.1.0 rubygems as malicious. It is considered malicious because: - The package...

CVE-2023-32758

giturlparse aka git-url-parse through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS Regular Expression Denial of Service if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package for example, to check whether it accesses any Git...

Incorrect decimal handling in _startAuction, resulting in wrong auction.startBidBps

Lines of code Vulnerability details Shortfall.startAuction uses the oracle price of the underlying tokens to price the pool bad debt: Shortfall.sol 389: for uint256 i; i the price returned by priceOracle.getUnderlyingPrice has a number of decimals equal to 36 - vToken decimals. This means the...

Malicious code in fusion-ng-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a24d384788c5f4810ac97c4f6ab429d9ef27b7dde67f62839ca68e7924695349 The OpenSSF Package Analysis project identified 'fusion-ng-theme' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-167 Malicious code in cfa-styleguide (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5562a6cb1d5f239216be52c28e8d316e8ffe0f490d11978863202a6fcfcbe8bc Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

MAL-2023-575 Malicious code in maddy_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx edb288f616afccdf20ab32d24f5f0616b0b2b91bcdb3d8f0d8bd60e1adbe6b0a Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

Threat Roundup for May 5 to May 12

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between May 5 and May 12. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Malicious code in ikea-jssdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c7ee2c27d65f23dc603308d3cb624e657745f399a18181feac7ab7a3d176d931 The OpenSSF Package Analysis project identified 'ikea-jssdk' @ 1.2.1 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1212 Malicious code in innotecsaludo (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c0835a79941b28db8905c92debfa5937bc9bb5707163402d7b82630d5f35fd14 The OpenSSF Package Analysis project identified 'innotecsaludo' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

Rockwell Automation ThinManager

1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Rockwell Automation Equipment: ThinManager Vulnerabilities: Inadequate Encryption Strength 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to decrypt traffic...

MAL-2023-1190 Malicious code in gql2ts-from-schema (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 7a1acee750c796d45e602f027ea638a05590a78bb142aca903bfb2bb169466a6 The OpenSSF Package Analysis project identified 'gql2ts-from-schema' @ 2.1.1 npm as malicious. It is considered malicious because: - The package...