98 matches found
CVE-2025-62491
A Use-After-Free UAF vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises ts-rejectedpromiselist. The function jsstdpromiserejectioncheck attempts to iterate over the rejectedpromiselist to report unhandled rejections usi...
DEBIAN-CVE-2025-62491
A Use-After-Free UAF vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises ts-rejectedpromiselist. The function jsstdpromiserejectioncheck attempts to iterate over the rejectedpromiselist to report unhandled rejections usi...
UBUNTU-CVE-2025-62491
A Use-After-Free UAF vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises ts-rejectedpromiselist. The function jsstdpromiserejectioncheck attempts to iterate over the rejectedpromiselist to report unhandled rejections usi...
CVE-2025-62491
The CVE-2025-62491 entry concerns a Use-After-Free (UAF) in the QuickJS engine’s standard library. The vulnerability occurs in js_std_promise_rejection_check when iterating the global rejected_promise_list; during error reporting, rp->reason may be an Error with a custom property getter, and e...
CVE-2025-62491 Use-after-free in js_std_promise_rejection_check in QuickJS
A Use-After-Free UAF vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises ts-rejectedpromiselist. The function jsstdpromiserejectioncheck attempts to iterate over the rejectedpromiselist to report unhandled rejections usi...
CVE-2025-62491
A Use-After-Free UAF vulnerability exists in the QuickJS engine's standard library when iterating over the global list of unhandled rejected promises ts-rejectedpromiselist. The function jsstdpromiserejectioncheck attempts to iterate over the rejectedpromiselist to report unhandled rejections usi...
QuickJS 安全漏洞
QuickJS is a small and embeddable Javascript engine open-sourced by QuickJS. A security vulnerability exists in QuickJS that stems from a post-release reuse issue when handling unprocessed rejected promise lists, which could lead to memory corruption...
Neon App pays users to record their phone calls, sells data for AI training [updated]
TechCrunch reports about a “bizarre app” inviting you to record and share your audio calls so that it can sell the data to AI companies. And if that’s not weird enough on its own, it’s ranking No. 2 in Apple's US app store at the time of writing. The name of the app is Neon Mobile and it promises...
Malicious code in http-promises-async (npm)
The package http-promises-async was found to contain malicious code...
MAL-2025-13386 Malicious code in @zalastax/nolb-promises (npm)
The package @zalastax/nolb-promises was found to contain malicious code...
Malicious code in @zalastax/nolb-promises (npm)
The package @zalastax/nolb-promises was found to contain malicious code...
MAL-2025-22763 Malicious code in http-promises-async (npm)
The package http-promises-async was found to contain malicious code...
Ghostwriting Scam
The variations seem to be endless. Here's a fake ghostwriting scam that seems to be making boatloads of money. This is a big story about scams being run from Texas and Pakistan estimated to run into tens if not hundreds of millions of dollars, viciously defrauding Americans with false hopes of...
Malicious code in requestz-promises (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f6eab2fca0656f140282d442e79f3edae4b6879f6e798147e1fe56f9aa34eda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2703 Malicious code in requestz-promises (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f6eab2fca0656f140282d442e79f3edae4b6879f6e798147e1fe56f9aa34eda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-2702 Malicious code in requests-promises (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f69e675db1c52596e208921e91e76489607213dc7f4f3c5ce9f9a824b02778e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
The evolution of the Kuiper ransomware
Kuiper Ransomware’s Evolution By Max Kersten · January 17, 2024 The Golang-based Kuiper ransomware is presented as an opportunity for other criminals to make money by ransoming one or more targets. Additionally, RobinHood, the actor behind Kuiper, states that help with operations can be provided...
Beware malware posing as beta versions of legitimate apps, warns FBI
The FBI has issued a warning that cybercriminals are embedding malicious code in mobile beta-testing apps in attempts to defraud potential victims. The victims are typically contacted on dating sites and social media, and in some cases they are promised incentives such as large financial payouts...
Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links
In what's a continuing assault on the open source ecosystem, over 15,000 spam packages have flooded the npm repository in an attempt to distribute phishing links. "The packages were created using automated processes, with project descriptions and auto-generated names that closely resembled one...
Mimalloc Can Allocate Memory with Bad Alignment
This crate depended on a promise regarding alignments made by the author of the mimalloc allocator to avoid using aligned allocation functions where possible for performance reasons. Since then, the mimalloc allocator's logic changed, making it break this promise. This caused this crate to return...