MAL-2025-2621 Malicious code in bsb-backup (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron 7c8850cc513318b8ede38268eed0fee01ba44c81087cd289294b63bada9f394c This package decodes and executes a script during installation to set up a Telegram bot for device event monitoring. However, the code is...

GHSA-MH63-6H87-95CP vulnerabilities

Vulnerabilities for packages: rclone, timestamp-authority, hydra, buildkitd, sigstore-scaffolding, trufflehog, k8sgpt, falcosidekick, guac, boring-registry, promxy, weaviate, tkn, openfga, filebrowser, atlantis, git-sync, step-kms-plugin, crossplane-provider-azure-storage, minio-operator, kaniko,...

CVE-2024-12580

A vulnerability in danny-avila/librechat prior to version 0.7.6 allows for logs debug injection. The parameters sessionId, fileId, userId, and fileid in the /code/download/:sessionId/:fileId and /download/:userId/:fileid APIs are not validated or filtered, leading to potential log injection...

Citrix DaaS - Error: Monitoring page could not be loaded [User authentication Failure]

New custom cloud administrators get the below error when trying to access Monitor console-...

Personal data revealed in released JFK files

Over 60,000 pages related to the 1963 assassination of US President John F. Kennedy were released as part of President Donald Trump’s directive on March 17, 2025, and while readers will not find a conclusive answer to the main question—nor will the files put an end to surrounding conspiracy...

CVE-2025-25068

creationtimestamp| type| source ---|---|--- 2025-03-21 11:48:02+00:00| seen| https://t.me/cvedetector/20804 2025-03-21 13:23:54+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkvcp5jqv72l 2025-08-11 18:27:49+00:00| seen| MISP/3e4b778d-5810-4171-a915-f1d106684af4...

CVE-2025-2311

Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event...

CVE-2025-2311

CVE-2025-2311 affects Sechard Information Technologies’ SecHard prior to 3.3.0.20220411. The root causes cited are Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, and Insufficiently Protected Credentials. Exposed impacts include Authentication Bypass, Interface ...

CVE-2025-2311 Authentication Bypass in Sechard Information Technologies' SecHard

Incorrect Use of Privileged APIs, Cleartext Transmission of Sensitive Information, Insufficiently Protected Credentials vulnerability in Sechard Information Technologies SecHard allows Authentication Bypass, Interface Manipulation, Authentication Abuse, Harvesting Information via API Event...

CVE-2024-8999

creationtimestamp| type| source ---|---|--- 2025-03-20 11:40:48+00:00| seen| https://bsky.app/profile/cyberalerts.bsky.social/post/3lksmhwizd52g 2025-03-20 12:48:33+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114194835864777020...

Why Continuous Compliance Monitoring Is Essential For IT Managed Service Providers

Regulatory compliance is no longer just a concern for large enterprises. Small and mid-sized businesses SMBs are increasingly subject to strict data protection and security regulations, such as HIPAA, PCI-DSS, CMMC, GDPR, and the FTC Safeguards Rule. However, many SMBs struggle to maintain...

PT-2025-12330

Name of the Vulnerable Software and Affected Versions Nebula Informatics SecHard versions prior to 3.3.0.20220411 Description The issue is related to the incorrect use of privileged APIs, cleartext transmission of sensitive information, and insufficiently protected credentials. This allows for...

MAL-2025-2599 Malicious code in bsb-family-bot (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron 73381c6a90c69556e5d81fd8b66b24eb30907c18f1b24a8a1de3635d533d3284 This package decodes and executes a script during installation to set up a Telegram bot for device event monitoring. However, the code is...

Securing Cloud Databases: Best Practices with ClickHouse and Wiz

How to protect sensitive data in cloud-hosted databases with built-in security controls, best practices, and continuous risk monitoring...

PostQuantum-Feldman-VSS'S Dependency Vulnerability in gmpy2 Leading to Interpreter Crash

Description: PostQuantum-Feldman-VSS, a Python library implementing Feldman's Verifiable Secret Sharing scheme with post-quantum security, was vulnerable to denial-of-service attacks in versions up to and including 0.7.6b0. This vulnerability stems from the library's reliance on the gmpy2 library...

Uptime Kuma security vulnerabilities

Uptime Kuma is an easy-to-use, self-hosted monitoring tool from the individual developer Louis Lam. A security vulnerability exists in Uptime Kuma 1.23.0 and prior versions that stems from a regular expression denial of service...

Video Surveillance Camera Unauthorized Access

The vulnerability of video surveillance cameras for monitoring and surveillance systems is related to insufficient protection of operational data. Exploiting this vulnerability can allow an unauthorized intruder to gain unauthorized access to protected information...

PT-2025-14089

Name of the Vulnerable Software and Affected Versions: Apache Parquet versions 1.15.0 and previous versions Description: A critical vulnerability in the Apache Parquet Java library allows attackers to execute arbitrary code on systems reading Parquet files. The vulnerability is caused by a...

CVE-2025-1507

creationtimestamp| type| source ---|---|--- 2025-03-14 08:46:03+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/7537 2025-03-14 12:31:48+00:00| seen| https://t.me/cvedetector/20285 2025-03-14 12:40:55+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3lkdmzxc3jj2k...

New MassJacker Malware Targets Piracy Users, Hijacking Cryptocurrency Transactions

Users searching for pirated software are the target of a new malware campaign that delivers a previously undocumented clipper malware called MassJacker, according to findings from CyberArk. Clipper malware is a type of cryware as coined by Microsoft that's designed to monitor a victim's clipboard...