`windows-service-rs` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...

PT-2023-36648

This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...

PT-2023-36646

This crate was part of a typosquatting malware cluster published by the user Kraded to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longer available...

cpython-json (>=0.1.0, <=0.3.0), crowbar (>=0.1.0, <=0.2.0) +26 more potentially affected by unknown CVE via cpython (>=0.1.0, <=0.7.2)

cpython CARGO version =0.1.0, =0.1.0, =0.1.0, =2.0.0-beta, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.3, =0.6.0, =0.1.1, =0.1.1, =0.1.8 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0076...

New Ransomware Group Emerges with Hive's Source Code and Infrastructure

The threat actors behind a new ransomware group called Hunters International have acquired the source code and infrastructure from the now-dismantled Hive operation to kick-start its own efforts in the threat landscape. "It appears that the leadership of the Hive group made the strategic decision...

btrfsutil (0.2.0), btrfsutil-fake (>=0.2.0-8324fe2, <=0.2.0) +13 more potentially affected by unknown CVE via loopdev (>=0.1.3, <=0.4.0)

loopdev CARGO version =0.1.3, =0.2.0-8324fe2, =0.1.0, =0.1.0, =0.6.3, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =2.4.2, =1.0.0, =3.0.0 - tweakster 0.0.3 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0088...

Dvenom - Tool That Provides An Encryption Wrapper And Loader For Your Shellcode

Double Venom DVenom is a tool that helps red teamers bypass AVs by providing an encryption wrapper and loader for your shellcode. Capable of bypassing some well-known antivirus AVs. Offers multiple encryption methods including RC4, AES256, XOR, and ROT. Produces source code in C, Rust, PowerShell...

Rocky Linux 8 : rust-toolset:rhel8 (RLSA-2022:1894)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2022:1894 advisory. - Rust is a multi-paradigm, general-purpose programming language designed for performance and safety, especially safe concurrency. The Rust Security Response WG...

Fedora 39 : firecracker / rust-aes-gcm (2023-17bdd59177)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-17bdd59177 advisory. - Update the aes-gcm crate to version 0.10.3. Addresses CVE-2023-42811. - Rebuild dependent packages firecracker for aes-gcm v0.10.3...

Fedora 39 : rust-askama / rust-askama_shared / rust-comrak (2023-aa46db07fd)

The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-aa46db07fd advisory. - Update comrak to version 0.18.0. - Disable the unused markdown support in askama and askamashared crates, which depends on an ancient version of...

Fedora 39 : rust-rustls-webpki (2023-4ae90bc849)

The remote Fedora 39 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-4ae90bc849 advisory. Update to version 0.100.2. This includes a fix for RUSTSEC-2023-0053 denial-of-service via crafted certificate chains. Tenable has extracted the preceding...

Rocky Linux 8 : rust-toolset:rhel8 (RLSA-2021:1935)

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2021:1935 advisory. - In the standard library in Rust before 1.49.0, String::retain function has a panic safety problem. It allows creation of a non-UTF-8 Rust string when...

Fedora 39 : rust-axum / rust-tokio-tungstenite / rust-tungstenite / rust-warp (2023-91a66898d2)

The remote Fedora 39 host has packages installed that are affected by a vulnerability as referenced in the FEDORA-2023-91a66898d2 advisory. - Update the axum crate to version 0.6.20. - Update the tokio-tungstenite crate to version 0.20.1. - Update the tungstenite crate to version 0.20.1. - Port...

Malware in ironfish-rust-nodejs

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

RUSTSEC-2023-0114 `tiny-server` was removed from crates.io for malicious code

This crate was part of a typosquatting malware cluster published by the malicious user http-tiny and contained a malware payload in build.rs to exfiltrate host information to the attacker. This advisory is to retrospectively document this attempted attack. The version information and download...

Rocky Linux 8 : rust-toolset:rhel8 (RLSA-2021:4270)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:4270 advisory. - library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, which in so...

MAL-2023-8419 Malicious code in ironfish-rust-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c72ce118b54d6f7c389cffe8b206419fdb96d698e61557ce25e5240a5ca6c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ironfish-rust-nodejs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 7c72ce118b54d6f7c389cffe8b206419fdb96d698e61557ce25e5240a5ca6c38 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

tinyfiledialogs-rs Security Vulnerabilities

tinyfiledialogs-rs is a tinyfiledialog library highly bound to Rust. A security vulnerability in tinyfiledialogs-rs prior to version 3.8.0, which stems from an incomplete fix in CVE-2020-36767, allows the use of shell metacharacters in headers, messages, and other input data, leading to code...

YoroTrooper: Researchers Warn of Kazakhstan's Stealthy Cyber Espionage Group

A relatively new threat actor known as YoroTrooper is likely made up of operators originating from Kazakhstan. The assessment, which comes from Cisco Talos, is based on their fluency in Kazakh and Russian, use of Tenge to pay for operating infrastructure, and very limited targeting of Kazakhstani...