MAL-2023-1156 Malicious code in docs-component-advanced-permission (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1a065d7fc179e436125a277398d58863cc0c5145b5220c893c09409bdd44807d The OpenSSF Package Analysis project identified 'docs-component-advanced-permission' @ 1.1.0 npm as malicious. It is considered malicious becaus...

MAL-2023-1159 Malicious code in docs-component-like (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cde662c7be657edd2cffb28c74114bf428fa1b9db283784ae67f159dbf201ce2 The OpenSSF Package Analysis project identified 'docs-component-like' @ 1.0.6 npm as malicious. It is considered malicious because: - The packag...

MAL-2023-1157 Malicious code in docs-component-folder-selector (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 029903e7351485fc54de0e50d6f2f3c9c822895bd8d97930476b5a69f23dd6f9 The OpenSSF Package Analysis project identified 'docs-component-folder-selector' @ 1.0.6 npm as malicious. It is considered malicious because: -...

Exploit for Improper Input Validation in Microsoft

CVE-2023-21554-PoC CVE-2023-21554 is a Windows MessageQueuin...

MAL-2023-1209 Malicious code in index-template-mets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 104f2ff9714322069aa6e619d7050de41349e85f4c3eaa04c4c25ba0e239e8a9 The OpenSSF Package Analysis project identified 'index-template-mets' @ 1.0.1 npm as malicious. It is considered malicious because: - The packag...

Malicious code in nightmaretestingpackage (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 6ecc46cf13068e4ebe6d534e65e7588e04bcafa5de43fa84a3b1ef4de5d79cad The OpenSSF Package Analysis project identified 'nightmaretestingpackage' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

kernel: tools/power turbostat: Fix file pointer leak

In the Linux kernel, the following vulnerability has been resolved: tools/power turbostat: Fix file pointer leak Currently if a fscanf fails then an early return leaks an open file pointer. Fix this by fclosing the file before the return. Detected using static analysis with cppcheck:...

The nature of cyberincidents in 2022

Kaspersky offers various services to organizations that have been targeted by cyberattackers, such as incident response, digital forensics, and malware analysis. In our annual incident response report, we share information about the attacks that we investigated during the reporting period. Data...

PT-2025-26111 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A potential buffer overflow issue has been identified in the Linux kernel, specifically in the ni set mc special registers function. The issue arises from the lack of bounds checking f...

MAL-2023-10 Malicious code in security-util-py (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 2309de1524c064d7eba8b0c288762426955241d23e00eaaeca7766758ab9054e The OpenSSF Package Analysis project identified 'security-util-py' @ 0.0.6 pypi as malicious. It is considered malicious because: - The package...

CVE-2023-23448

Inclusion of Sensitive Information in Source Code in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows a remote attacker to gain information about valid usernames via analysis of source code...

MAL-2023-1226 Malicious code in lexicalutils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 74435494f223aa6bbba50c2e8e746a27b089ed5df8eabcb948a7bab06cc57e74 The OpenSSF Package Analysis project identified 'lexicalutils' @ 99.9.9 npm as malicious. It is considered malicious because: - The package...

MAL-2023-1427 Malicious code in i18n_sonder (RubyGems)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 9f0c939067907bb4e3bd0d91530b128f2ffe8c595d619eaa3ab544891de51e2b The OpenSSF Package Analysis project identified 'i18nsonder' @ 4.1.0 rubygems as malicious. It is considered malicious because: - The package...

CVE-2023-32758

giturlparse aka git-url-parse through 1.2.2, as used in Semgrep 1.5.2 through 1.24.1, is vulnerable to ReDoS Regular Expression Denial of Service if parsing untrusted URLs. This might be relevant if Semgrep is analyzing an untrusted package for example, to check whether it accesses any Git...

Incorrect decimal handling in _startAuction, resulting in wrong auction.startBidBps

Lines of code Vulnerability details Shortfall.startAuction uses the oracle price of the underlying tokens to price the pool bad debt: Shortfall.sol 389: for uint256 i; i the price returned by priceOracle.getUnderlyingPrice has a number of decimals equal to 36 - vToken decimals. This means the...

Malicious code in fusion-ng-theme (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis a24d384788c5f4810ac97c4f6ab429d9ef27b7dde67f62839ca68e7924695349 The OpenSSF Package Analysis project identified 'fusion-ng-theme' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

MAL-2023-167 Malicious code in cfa-styleguide (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 5562a6cb1d5f239216be52c28e8d316e8ffe0f490d11978863202a6fcfcbe8bc Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

MAL-2023-575 Malicious code in maddy_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx edb288f616afccdf20ab32d24f5f0616b0b2b91bcdb3d8f0d8bd60e1adbe6b0a Malicious packages campaign since 2021 targeting developers, steals source code and secrets Source: ghsa-malware...

Threat Roundup for May 5 to May 12

Today, Talos is publishing a glimpse into the most prevalent threats weve observed between May 5 and May 12. As with previous roundups, this post isnt meant to be an in-depth analysis. Instead, this post will summarize the threats weve observed by highlighting key behavioral characteristics,...

Malicious code in ikea-jssdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis c7ee2c27d65f23dc603308d3cb624e657745f399a18181feac7ab7a3d176d931 The OpenSSF Package Analysis project identified 'ikea-jssdk' @ 1.2.1 npm as malicious. It is considered malicious because: - The package...