Malicious code in tdm-shared-core-library (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis f40d5eac324a286d10c565745ab72ab39f4b9ffa1fc95fc0bbf40101f44a6955 The OpenSSF Package Analysis project identified 'tdm-shared-core-library' @ 99.0.3 npm as malicious. It is considered malicious because: - The...

kernel: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds Set the size to 6 instead of 2, since 'para' array is passed to 'rtwfwbtwificontrolrtwdev, para0, &para1', which reads 5 bytes: void rtwfwbtwificontrolstruct...

Timing Attack

Overview Affected versions of this package are vulnerable to Timing Attack via the WorkflowException error messages. An attacker can infer the existence of ERC by measuring differences in response times. Remediation Upgrade com.liferay:com.liferay.portal.workflow.api to version 11.0.1 or higher...

Vulnerability-identification-and-Mitigation

It is an offensive tool for source code and SMS message analysis...

A Non-Monotonic Relationship: an Empirical Analysis of Hybrid Quantum Classifiers for Unseen Ransomware Detection

Detecting unseen ransomware is a critical cybersecurity challenge where classical machine learning often fails. While Quantum Machine Learning QML presents a potential alternative, its application is hindered by the dimensionality gap between classical data and quantum hardware. This paper...

A Decade-Long Landscape of Advanced Persistent Threats: Longitudinal Analysis and Global Trends

An advanced persistent threat APT refers to a covert, long-term cyberattack, typically conducted by state-sponsored actors, targeting critical sectors and often remaining undetected for long periods. In response, collective intelligence from around the globe collaborates to identify and trace...

ALPHA: LLM-Enabled Active Learning for Human-Free Network Anomaly Detection

Network log data analysis plays a critical role in detecting security threats and operational anomalies. Traditional log analysis methods for anomaly detection and root cause analysis rely heavily on expert knowledge or fully supervised learning models, both of which require extensive labeled dat...

internalblue

This is an offensive tool for Bluetooth experimentation. It is a Bluetooth experimentation framework for Broadcom and Cypress chips, which enables various features that would otherwise only be possible with a full-stack software-defined radio implementation, such as injecting and monitoring packe...

maltrail

It is an offensive tool for network traffic analysis. The primary CVE ID is not present in the provided context, but the tool is designed to detect malicious traffic. The target product/service or framework is not explicitly stated, but it is likely a network traffic analysis system. The...

Bridgestone Confirms Cyberattack Disrupting North American Plants

Bridgestone confirms a cyberattack that disrupted manufacturing plants. This article details the impact on employees, expert analysis, and…...

CVE-2025-39713

In the Linux kernel, the following vulnerability has been resolved: media: rainshadow-cec: fix TOCTOU race condition in raininterrupt In the interrupt handler raininterrupt, the buffer full check on rain-buflen is performed before acquiring rain-buflock. This creates a Time-of-Check to Time-of-Us...

Malicious code in jfrog-alfheim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81aec3e5e257dac330f6d3f73c310c476b4926e6cd0040f2ac70b7a4f45005aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-42150 Malicious code in jfrog-alfheim (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81aec3e5e257dac330f6d3f73c310c476b4926e6cd0040f2ac70b7a4f45005aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in file-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis db9d9ac2b90c17d04ff56afe81a886e99665eb55048e7cc7c9a3f0b1855db828 The OpenSSF Package Analysis project identified 'file-dependency' @ 7.0.1 npm as malicious. It is considered malicious because: - The package...

FuzzRDUCC: Fuzzing with Reconstructed Def-Use Chain Coverage

Binary-only fuzzing often struggles with achieving thorough code coverage and uncovering hidden vulnerabilities due to limited insight into a program's internal dataflows. Traditional grey-box fuzzers guide test case generation primarily using control flow edge coverage, which can overlook bugs n...

Exploit for Out-of-bounds Write in Vmware Cloud_Foundation

CVE-2021-21974 Vulnerability Detector A Python-based security...

MAL-2025-45999 Malicious code in sfly-services (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware da589d8876d458397b3e7aa677e83cb9f21a92526a613fa62808be5946105774 Any computer that has this package installed or running should be considered...

Malicious code in collabs-influencer-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 313990126cb820aa31d04033f63105e8a07118c14e0ec49cd4ce0c67c1f60c47 The OpenSSF Package Analysis project identified 'collabs-influencer-ui' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

OS Command injection vulnerability in sleuthkit fls tool 4.11.1 allows attackers to execute arbitrary commands via a crafted value to the m parameter. NOTE: third parties have disputed this because there is no analysis showing that the backtick command executes outside the context of the user account that entered the command line.

...

Systematic Timing Leakage Analysis of NIST PQDSS Candidates: Tooling and Lessons Learned

The PQDSS standardization process requires cryptographic primitives to be free from vulnerabilities, including timing and cache side-channels. Resistance to timing leakage is therefore an essential property, and achieving this typically relies on software implementations that follow constant-time...