agnes (>=0.3.0, <=0.3.2), agpm_interactions (0.0.1) +408 more potentially affected by unknown CVE via prettytable-rs (>=0.5.2, <=0.9.0)

prettytable-rs CARGO version =0.5.2, =0.3.0, =0.1.0, =0.2.3, =1.0.0, =0.1.0, =0.1.1, =3.1.3, =0.2.0, =0.2.0, =0.5.1, =0.1.0, =0.2.0, =0.3.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-GFGM-CHR3-X6PX...

Nokoyawa 2.0 A Reworked Rust-Based Ransomware

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary Nokoyawa is a 64-bit Windows-based ransomware family that first appeared in early February 2022. The threat group behind Nokoyawa conducts double-extortion ransomware attacks, first stealing data from...

Fedora 36 : rust-capnp / rust-sequoia-octopus-librnp (2022-fd7eeedd02)

The remote Fedora 36 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2022-fd7eeedd02 advisory. Update the capnp crate to version 0.14.11 to address CVE-2022-46149 / RUSTSEC-2022-0068. This update also includes a rebuild of the only affected application...

can2040 (>=0.1.2, <=0.1.5), card10-alloc (>=0.1.0, <=0.1.1) +13 more potentially affected by unknown CVE via alloc-cortex-m (>=0.2.2, <=0.4.4)

alloc-cortex-m CARGO version =0.2.2, =0.1.2, =0.1.0, =0.1.0, =0.0.4, =0.3.2, =0.1.0, =0.1.0, =0.5.6, =0.1.0, =0.1.1, =0.0.2, =0.0.11 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0073...

Ransomware Hackers Using New Way to Bypass MS Exchange ProxyNotShell Mitigations

Threat actors affiliated with a ransomware strain known as Play are leveraging a never-before-seen exploit chain that bypasses blocking rules for ProxyNotShell flaws in Microsoft Exchange Server to achieve remote code execution RCE through Outlook Web Access OWA. "The new exploit method bypasses...

Agenda ransomware made its return with a Rust variant

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary In addition to BlackCat, Hive, Luna, and RansomExx, Agenda is the latest ransomware strain to use the cross-platform programming language Rust. Ransomware-as-a-service RaaS group Agenda, attributed to an...

New Agenda Ransomware Variant, Written in Rust, Aiming at Critical Infrastructure

A Rust variant of a ransomware strain known as Agenda has been observed in the wild, making it the latest malware to adopt the cross-platform programming language after BlackCat, Hive, Luna, and RansomExx. Agenda, attributed to an operator named Qilin, is a ransomware-as-a-service RaaS group that...

Agenda Ransomware Uses Rust to Target More Vital Industries

This year, various ransomware-as-a-service groups have developed versions of their ransomware in Rust, including Agenda. Agenda's Rust variant has targeted vital industries like its Go counterpart. In this blog, we will discuss how the Rust variant works...

ibc (>=0.11.0, <=0.19.0), ibc-relayer (>=0.11.0, <=0.19.0) +6 more potentially affected by CVE-2022-23507 via tendermint-light-client-verifier (>=0.23.5, <=0.27.0)

tendermint-light-client-verifier CARGO version =0.23.5, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.11.0, =0.15.0, =0.23.5, =0.23.0, =0.27.0 Source cves: CVE-2022-23507 Source advisory: OSV:GHSA-XQQC-C5GW-C5R5...

roaring-landmask (0.4.0) potentially affected by CVE-2022-3996 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-3996 Source advisory: OSV:GHSA-VR8J-HGMM-JH9R...

Malware Strains Targeting Python and JavaScript Developers Through Official Repositories

An active malware campaign is targeting the Python Package Index PyPI and npm repositories for Python and JavaScript with typosquatted and fake modules that deploy a ransomware strain, marking the latest security issue to affect software supply chains. The typosquatted Python packages all...

blockbuster (0.0.2) potentially affected by unknown CVE via mpl-bubblegum (0.1.1)

mpl-bubblegum CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on mpl-bubblegum and may be impacted: - blockbuster 0.0.2 Source cves: unknown CVE Source advisory: OSV:GHSA-8R76-FR72-J32W...

[SECURITY] Fedora 36 Update: rust-capnp-0.14.11-1.fc36

Runtime library for Cap'n Proto data encoding...

[SECURITY] Fedora 36 Update: rust-sequoia-octopus-librnp-1.4.1-2.fc36

Reimplementation of RNP's interface using Sequoia for use with Thunderbird...

[SECURITY] Fedora 37 Update: rust-capnp-0.14.11-1.fc37

Runtime library for Cap'n Proto data encoding...

Fedora: Security Advisory for rust-sequoia-octopus-librnp (FEDORA-2022-7002ec8b22)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rust-capnp (FEDORA-2022-7002ec8b22)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rust-capnp (FEDORA-2022-fd7eeedd02)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for rust-sequoia-octopus-librnp (FEDORA-2022-fd7eeedd02)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

GHSA-969W-Q74Q-9J8V Unsound API in `secp256k1` allows use-after-free and invalid deallocation from safe code

Because of incorrect bounds on method Secp256k1::preallocatedgennew it was possible to cause use-after-free from safe consumer code. It was also possible to "free" memory not allocated by the appropriate allocator. The method takes a place for storing the context as a mutable reference and return...