CVE-2023-31290

CVE-2023-31290 affects Trust Wallet Core prior to 3.1.1 used in the Trust Wallet browser extension prior to 0.0.183. The root cause is insufficient entropy: mt19937 seed uses a single 32-bit value, yielding only 4 billion possible mnemonics. Affected browser-extension versions are 0.0.172–0.0.182...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

VulnCheck KEV: CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

CVE-2023-31290

Trust Wallet Core before 3.1.1, as used in the Trust Wallet browser extension before 0.0.183, allows theft of funds because the entropy is 32 bits, as exploited in the wild in December 2022 and March 2023. This occurs because the mt19937 Mersenne Twister takes a single 32-bit value as an input...

New Rilide Malware Targeting Chromium-Based Browsers to Steal Cryptocurrency

Chromium-based web browsers are the target of a new malware called Rilide that masquerades itself as a seemingly legitimate extension to harvest sensitive data and siphon cryptocurrency. "Rilide malware is disguised as a legitimate Google Drive extension and enables threat actors to carry out a...

ChromeLoader Malware Targeting Gamers via Fake Nintendo and Steam Game Hacks

A new ChromeLoader malware campaign has been observed being distributed via virtual hard disk VHD files, marking a deviation from the ISO optical disc image format. "These VHD files are being distributed with filenames that make them appear like either hacks or cracks for Nintendo and Steam games...

SUSE CVE-2014-3172

The Debugger extension API in browser/extensions/api/debugger/debuggerapi.cc in Google Chrome before 37.0.2062.94 does not validate a tab's URL before an attach operation, which allows remote attackers to bypass intended access limitations via an extension that uses a restricted URL, as...

SUSE CVE-2017-7820

The "instanceof" operator can bypass the Xray wrapper mechanism. When called on web content from the browser itself or an extension the web content can provide its own result for that operator, possibly tricking the browser or extension into mishandling the element. This vulnerability affects...

Python Developers Beware: Clipper Malware Found in 450+ PyPI Packages!

Malicious actors have published more than 451 unique Python packages on the official Python Package Index PyPI repository in an attempt to infect developer systems with clipper malware. Software supply chain security company Phylum, which spotted the libraries, said the ongoing activity is a...

Malicious code in tkcalenddar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 325b2ed0fe011dd5d2f571984f69db6e439c5c2647752eabd2b0cb7848e722da Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcalendra (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx dd65f2c94fec35121de0dd1448e48824d9236968ead1512d8474404e0d4a1806 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkkcalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 4dfe6635d443d00fa1ee3c506a1d4f06835a5875737720dd724a4475e7010359 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in ktcalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 3dae7c8d1185e6518c9e9358deb5aaa5806eb6b2b206a8b05731baa4a45a5b9c Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcalednar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2751263c8ef9db6ea790ea61f6c7150637a90527d732057cb54706619c31cca7 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in ttkcalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx fe53354ad712e586c9dd05c583a5f6e31f9c7aa60bda1acb85d395e821d97d0b Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tcalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 51218378709bfe987aadc08f4c49c00938dd166c52ea0f450de5b7ce9ba1289a Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcalendaar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b3977a3ca29cde900c0bc5b8ca7b208dc26c6cebc7b606b233ed1cb0764b7c00 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tckalendar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7898cef0731e3cdb0ad90fe1f0132a6a3ce1ef4787deac1f79076a81339f69cf Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcalendarr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx a322359b90be8e13f7e6aaf88275d81ce33a6aa40b88a4c53bd70390df182dae Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...

Malicious code in tkcaelndar (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 8c49be3ad2a45b16c6ad5922865a55eb1b6086e4af4f531855090f53be356741 Attacker distributed 900+ malicious packages via PyPi, infecting local browsers with malicious extension to manipulate clipboard and replace crypto wallet...