MAL-2023-6082 Malicious code in selfgamepypost (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b752d0d154d23b39a06208732e66acc078f25853c4e8773d6810722a5518d98a EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-3905 Malicious code in libcontrolhttpstr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ec54d33b4978cf8aeb5ed3e67dbc5b622f0765d0812587bb826940a7ea1aa67f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices

A pair of serious security defects has been disclosed in the Trusted Platform Module TPM 2.0 reference library specification that could potentially lead to information disclosure or privilege escalation. One of the vulnerabilities, CVE-2023-1017 , concerns an out-of-bounds write, while the other,...

New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices

A pair of serious security defects has been disclosed in the Trusted Platform Module TPM 2.0 reference library specification that could potentially lead to information disclosure or privilege escalation. One of the vulnerabilities, CVE-2023-1017, concerns an out-of-bounds write, while the other,...

New MQsTTang Backdoor from Mustang Panda Targets Political and Governmental Organizations

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary A new custom backdoor called MQsTTang, which they attribute to the Mustang Panda APT group. This backdoor is part of an ongoing campaign that began in early January...

Malicious code in esqpepintpyw (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 368fe1092720900811040e8a04fb59f08fb55eec4e4d33881fee139afe8d7ba0 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4490 Malicious code in librereplacereplace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ed5f0755a7800e998ae73116017f01e08d7ac92b669ce4157d879508b3faae8b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5707 Malicious code in py-ultrageturl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 01930305a64fa02060ad5c305f01da7c89a1a0d944c7425354d0dc3a43f8d737 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tppylgtbnvidia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 902f6b3dd565bb41847f637f72fe2dd7c288d9b3e814758143c6147aab78b456 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7476 Malicious code in tppyrandomed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7ae4f35f4b62a39c439b16d5a81eb24398dc404bb527e2543e524bfc543da367 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7664 Malicious code in tptoolpywgui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 13ae482293b38eb9a03870f3e171704aa0f874d8bd2d844f29b891e26bee00f7 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Kubernetes vulnerable to path traversal

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

CVE-2023-25173

A flaw was found in containerd, where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some...

AZL-25938 CVE-2022-3162 affecting package prometheus-adapter for versions less than 0.10.0-17

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-13782 CVE-2022-3162 affecting package kube-vip-cloud-provider for versions less than 0.0.2-21

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

CVE-2022-3162

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-31287 CVE-2022-3162 affecting package kubernetes for versions less than 1.25.4-0

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-13780 CVE-2022-3162 affecting package cert-manager for versions less than 1.11.2-1

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

DEBIAN-CVE-2022-3162

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

AZL-13783 CVE-2022-3162 affecting package rook for versions less than 1.6.2-25

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...