Active Water Saci Campaign Spreading Via WhatsApp Features Multi-Vector Persistence and Sophisticated C&C

Continuous investigation on the Water Saci campaign reveals innovative email-based C&C system, multi-vector persistence, and real-time command capabilities that allow attackers to orchestrate coordinated botnet operations, gather detailed campaign intelligence, and dynamically control malware...

PT-2025-44043

Name of the Vulnerable Software and Affected Versions Docker Compose versions prior to 2.40.2 Description Docker Compose is affected by a path traversal flaw stemming from improper restriction of path names to accessible directories. This issue allows a remote attacker to overwrite arbitrary file...

Malicious code in gear-bridge-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74e84b9a555df93618c5127eddd0b90f79c79e8b54a5c60a0deb241487f867d7 The OpenSSF Package Analysis project identified 'gear-bridge-common' @ 1337.1.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-48607 Malicious code in gear-bridge-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74e84b9a555df93618c5127eddd0b90f79c79e8b54a5c60a0deb241487f867d7 The OpenSSF Package Analysis project identified 'gear-bridge-common' @ 1337.1.0 npm as malicious. It is considered malicious because: - The...

MAL-2025-48606 Malicious code in gear-js-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 08293e303cb9ccb253d0503e6c9a51606f052ca75e735030f6985425728f7e69 The OpenSSF Package Analysis project identified 'gear-js-util' @ 1337.1.0 npm as malicious. It is considered malicious because: - The package...

Malicious code in orderbook-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed7b538ac9c8ab390683e5923fed557542d1a2cbeda2aee3ed14627473bd4779 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48602 Malicious code in orderbook-backend (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ed7b538ac9c8ab390683e5923fed557542d1a2cbeda2aee3ed14627473bd4779 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in orderbook-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 520e53ed5a79dd5b7c8eb56d8a963c7688a2425f5ef1bd45fe64668c8954eaf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48603 Malicious code in orderbook-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 520e53ed5a79dd5b7c8eb56d8a963c7688a2425f5ef1bd45fe64668c8954eaf3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-58428

The TLS4B ATG system's SOAP-based interface is vulnerable due to its accessibility through the web services handler. This vulnerability enables remote attackers with valid credentials to execute system-level commands on the underlying Linux system. This could allow the attacker to achieve remote...

Malicious code in cooler-loans-api-generate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14591c09547262270253b5ec14b726249679f72985f6e450ba0cf5198ee216af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48600 Malicious code in cooler-loans-api-generate (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 14591c09547262270253b5ec14b726249679f72985f6e450ba0cf5198ee216af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48601 Malicious code in cooler-loans-api-get (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bf5016290eaec4debcd0e35dda5e684927f8e80c05f9ca16252c71ea8cca6de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cooler-loans-api-get (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4bf5016290eaec4debcd0e35dda5e684927f8e80c05f9ca16252c71ea8cca6de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @eqder/bird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7acc999c2ea175e62266081a166ad731b10ac9621b965f28186121fbece6a1bb The package @eqder/bird was found to contain malicious code. Source: ossf-package-analysis...

MAL-2025-48946 Malicious code in @eqder/bird (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7acc999c2ea175e62266081a166ad731b10ac9621b965f28186121fbece6a1bb The package @eqder/bird was found to contain malicious code. Source: ossf-package-analysis...

CVE-2025-10680

OpenVPN 2.7alpha1 through 2.7beta1 on POSIX based platforms allows a remote authenticated server to inject shell commands via DNS variables when --dns-updown is in use...

WatchGuard Fireware OS 安全漏洞

WatchGuard Fireware OS is a software from WatchGuard USA that runs on Firebox. A security vulnerability exists in WatchGuard Fireware OS version 12.0 through versions prior to 12.11.2, which originates from an administrator user being able to enable a debug shell by uploading a specific diagnosti...

EulerOS 2.0 SP13 : cloud-init (EulerOS-SA-2025-2284)

According to the versions of the cloud-init package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : cloud-init is an industry-standard multi-distribution method for cross-platform cloud instance initialization by Canonical. There is a security...

NewStart CGSL MAIN 7.02 : sudo Multiple Vulnerabilities (NS-SA-2025-0246)

The remote NewStart CGSL host, running version MAIN 7.02, has sudo packages installed that are affected by multiple vulnerabilities: - Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user- controlled directory is used with the --chroot option...