12998 matches found
CVE-2025-4570
An insecure sensitive key storage issue was found in MyASUS. potentially allowing unauthorized actor to obtain a token that could be used to communicate with certain services. Refer to the 'Security Update for for MyASUS' section on the ASUS Security Advisory for more information...
CVE-2025-4569
CVE-2025-4569 affects ASUS MyASUS. The issue is an insecure sensitive key storage bug that could allow an unauthenticated actor to obtain a token used to access certain services. CVSSv4.0 vector indicates network attack with low complexity, no privileges required, and high impact on confidentiali...
PT-2025-30246 · Asus · Myasus
Name of the Vulnerable Software and Affected Versions: MyASUS affected versions not specified Description: An issue involving insecure storage of sensitive keys was identified in MyASUS. This could potentially allow an unauthorized actor to obtain a token used for communication with certain...
MAL-2025-6063 Malicious code in @toptal/picasso-slider (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6056 Malicious code in @toptal/picasso-popper (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6041 Malicious code in @toptal/picasso-button (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-logo (npm)
The package communicates with a domain associated with malicious activity...
A Privacy-Centric Approach: Scalable and Secure Federated Learning Enabled by Hybrid Homomorphic Encryption
Federated Learning FL enables collaborative model training without sharing raw data, making it a promising approach for privacy-sensitive domains. Despite its potential, FL faces significant challenges, particularly in terms of communication overhead and data privacy. Privacy-preserving Technique...
Malicious code in everestsystems-content-core (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis b1e36c55069fe1374c19441b5e3cbabd0ba1bc120d2d1651dd5570157a8a9c57 The OpenSSF Package Analysis project identified...
CVE-2025-6227 Invite token is used as part of the secure communication
Mattermost versions 10.5.x = 10.5.7, 9.11.x = 9.11.16 fail to negotiate a new token when accepting the invite which allows a user that intercepts both invite and password to send synchronization payloads to the server that originally created the invite via the REST API...
Malicious code in @jssrv/template (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ce87403bb05aae59ca8877b014a3a8255b54b2a22e930687649c675cc9602f76 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2025-6209 Malicious code in marcom-ac-console (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 64d378ac078f27f1f0357746b50307c933999c2eb82b5c9c7a7a6b0645910749 The OpenSSF Package Analysis project identified 'marcom-ac-console' @ 1.0.5 npm as malicious. It is considered malicious because: - The package...
Malicious code in dascxcxcxcxcxcxxc (npm)
--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8b679a7ed981cd77671778267b213920e462f2f9e5ae49ba61967779efb331aa The OpenSSF Package Analysis project identified 'dascxcxcxcxcxcxxc' @ 1.0.1 npm as malicious. It is considered malicious because: - The package...
Malicious code in @company-internal/logger (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9d0932de39c3f8c9bcb34c9f241df2d154d4659532cfddb67ddd06e283c38c14 Any computer that has this package installed or running should be considered...
Malicious code in vercel-edge (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 705d265f51a6811b9f95fdbe239738b37767248d5e0b8b66cf689b122f4a96c9 The OpenSSF Package Analysis project identified 'vercel-edge' @ 99.5....
Malicious code in node-ts-esm-auto (npm)
The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=-...
MAL-2025-5983 Malicious code in npmdeco (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c7c7110ed52ce1bc50ece55d4ed6f010f23d0ec5383c3b482208028e97eeab9c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Hacking Trains
Seems like an old system system that predates any care about security: The flaw has to do with the protocol used in a train system known as the End-of-Train and Head-of-Train. A Flashing Rear End Device FRED, also known as an End-of-Train EOT device, is attached to the back of a train and sends...
MAL-2025-5982 Malicious code in datadog-instrumentations (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cbf74efed2b32abd010705d5410e78270b572065e8fc02c3a1961b4afc2585ba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...