BumbleCrypt

BumbleCrypt A Bumblebee-inspired Crypter Background The BumbleCrypt is inspired by Bumblebee's crypter, in Bumblebee's case the main Bumblebee DLL is been loaded in the memory and executed in the following way: Decrypts and writes the payload in the Heap Hooks three NtApi's - NtOpenFile,...

moveit-payload-decrypt-CVE-2023-34362

moveit-payload-decrypt-CVE-2023-34362 This shellscript given the OrgKey 0 will parse the header of the base64 artifacts found in MOVEit Logs and decrypt the Serialized object used a payload...

CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

CVE-2026-108126 temporal-proxy payload decryption is not bound to the request namespace

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext...

MAL-2026-13518 Malicious code in postcss-theme-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...

MAL-2026-10680 Malicious code in syncgrove (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6c96b3528ab792944d243b00ae61facc33740850b5cb2ed19671fd6732e43494 The package's postinstall lifecycle script contacts a hardcoded plain-HTTP endpoint at http://player.sweeprovider.org, retrieves a key via /getKey.ph...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

MAL-2026-6762 Malicious code in node-pino (npm)

node-pino is a one-edit typosquat of the popular pino logger that ships repackaged winston plus a malicious postinstall dropper. On npm install, the postinstall hook npm run license - node lib/winston/license spawns a DETACHED, unref'd child process that reads an AES-256-CBC-encrypted blob...

cve-2026-41694 - LOW - SAML Payloads Decrypted Without Valid Signature

cve-2026-41694 - LOW - SAML Payloads Decrypted Without Valid Signature...

Multi‑Layer Encrypted Python Payload Loader AES‑GCM + XOR + Zlib

This Python script acts as a loader that decrypts and executes a protected Python payload using multiple cryptographic and obfuscation layers. The program first requests a password from the user and derives a 256‑bit encryption key using PBKDF2 with a fixed salt salt123. The encrypted payload is...

Keysight Ixia Vision security vulnerabilities

Keysight Ixia Vision is a series of network packet proxies from Keysight Corporation USA. A security vulnerability exists in Keysight Ixia Vision that stems from hard-coded cryptographic material that could lead to the interception or decryption of payloads...

Important: Red Hat Security Advisory: skopeo security update

An update for skopeo is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...

CVE-2022-1279

A vulnerability in the encryption implementation of EBICS messages in the open source librairy ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt EBICS payloads. This issue affects: ebics-java/ebics-java-client versions prior to 1.2...

EBICS Java Client security vulnerability

EBICS Java Client is a Java open source EBICS client. It is used to interact with banks using EBICS Electronic Banking Internet Communications Standard. A security vulnerability exists in EBICS Java Client versions prior to 1.2, which stems from a problem with the cryptographic implementation of...

PT-2022-13769 · Unknown · Ebics-Java/Ebics-Java-Client

Name of the Vulnerable Software and Affected Versions: ebics-java/ebics-java-client versions prior to 1.2 Description: A vulnerability in the encryption implementation of EBICS messages in the open source library ebics-java/ebics-java-client allows an attacker sniffing network traffic to decrypt...