Hackers Drain $1.48 Billion from Crypto in 2024, Led by DeFi Exploits

Hackers stole $1.48 billion from the crypto industry in 2024. A new report highlights trends in blockchain security, including shifts in target networks...

The vulnerability of the Linux operating system’s crypto kernel component, which allows a hacker to trigger a service failure

The vulnerability of the Linux operating system’s crypto kernel component is related to errors in resource management in the pcryptaeadencrypt function. Exploiting this vulnerability can allow an attacker to cause a service failure...

Malicious code in crypto-jsonwebtoken (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25abe83f5832dadd36db735f0f385e70d4f55987a913448a70c7df4ea1c28762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11132 Malicious code in crypto-bignumber (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ceb07bdcd8a1158c33a46eefd3724fe1ec53b7ed6c4cba581fdda9deb084c0af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in crypto-bignumber (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ceb07bdcd8a1158c33a46eefd3724fe1ec53b7ed6c4cba581fdda9deb084c0af Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11133 Malicious code in crypto-jsonwebtoken (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 25abe83f5832dadd36db735f0f385e70d4f55987a913448a70c7df4ea1c28762 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-11134 Malicious code in crypto-keccak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac0a5adb7e28cfa79e7a7659ad41ab9a29f21b5bcf01a33f230020610900850a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in crypto-keccak (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac0a5adb7e28cfa79e7a7659ad41ab9a29f21b5bcf01a33f230020610900850a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

An issue was discovered in Mbed TLS 2.18.0 through 2.28.x before 2.28.8 and 3.x before 3.6.0 and Mbed Crypto. The PSA Crypto API mishandles shared memory.

...

gitea -- multiple vulnerabilities

Problem Description: Fix delete branch perm checking Upgrade crypto library...

GHSA-486G-47CC-8WXF aiocpa contains credential harvesting code

aiocpa is a user-facing library for generating color gradients of text. Version 0.1.13 introduced obfuscated, malicious code targeting Crypto Pay users, forwarding client credentials to a remote Telegram bot. All versions have been removed from PyPI...

aiocpa contains credential harvesting code

aiocpa is a user-facing library for generating color gradients of text. Version 0.1.13 introduced obfuscated, malicious code targeting Crypto Pay users, forwarding client credentials to a remote Telegram bot. All versions have been removed from PyPI...

PYSEC-2024-152 aiocpa 0.1.13 contains credential harvesting code

aiocpa is a user-facing library for generating color gradients of text. Version 0.1.13 introduced obfuscated, malicious code targeting Crypto Pay users, forwarding client credentials to a remote Telegram bot. All versions have been removed from PyPI...

PyPI Python Library "aiocpa" Found Exfiltrating Crypto Keys via Telegram Bot

The administrators of the Python Package Index PyPI repository have quarantined the package "aiocpa " following a new update that included malicious code to exfiltrate private keys via Telegram. The package in question is described as a synchronous and asynchronous Crypto Pay API client. The...

Malicious code in crypto-puch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac46e66a58a4b83fff27b66b7372f575870fe1abb4ae286e8e1c46ba2109af19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10921 Malicious code in crypto-puch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ac46e66a58a4b83fff27b66b7372f575870fe1abb4ae286e8e1c46ba2109af19 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10929 Malicious code in eth-crpto (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 39a8ec071ac26f1f07a77c2de3dcff7672716e7339455c06896de0d1b7e905bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2024-40899 · Pypi · Aiocpa

Name of the Vulnerable Software and Affected Versions: aiocpa versions prior to the removal from PyPI Description: The issue concerns a user-facing library used for generating color gradients of text. It was discovered that version 0.1.13 introduced obfuscated, malicious code. This code targets...

The vulnerability of the tipc_crypto_rcv_complete() function in the Linux operating system allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the tipccryptorcvcomplete function in the net/tipc/crypto.c module of the Linux kernel is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and accessibility of the...

CVE-2024-11365

The Crypto and DeFi Widgets – Web3 Cryptocurrency Shortcodes plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.1.6. This makes it possible for unauthenticated attackers...