Malicious code in brum-global-variable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57eb73c6cef367bf2c5464967ed374a34f64862b3598ebae764c8b292f5d47e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-8099 Malicious code in brum-global-variable (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 57eb73c6cef367bf2c5464967ed374a34f64862b3598ebae764c8b292f5d47e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in purplebricks-administration (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 166a338cbf2061c2c522db795a33313847ac718197150d27111861792523592c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-40729

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application lacks security control to prevent unencrypted communication without HTTPS. An attacker who managed to gain machine-in-the-middle position could manipulate, or steal confidential information...

Design/Logic Flaw

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application lacks security control to prevent unencrypted communication without HTTPS. An attacker who managed to gain machine-in-the-middle position could manipulate, or steal confidential information...

CVE-2023-40729

A vulnerability has been identified in QMS Automotive All versions V12.39. The affected application lacks security control to prevent unencrypted communication without HTTPS. An attacker who managed to gain machine-in-the-middle position could manipulate, or steal confidential information...

CVE-2023-40729

CVE-2023-40729 affects Siemens QMS Automotive: all versions prior to V12.39 are vulnerable due to unencrypted (HTTPS-free) communications, enabling MITM manipulation or theft of confidential data. Connected documents confirm the issue in QMS Automotive and specify the root cause as lack of securi...

Free Download Manager backdoored – a possible supply chain attack on Linux machines

UPDATE 13.09.2023. Free Download Manager team issued an official statement regarding this incident. Over the last few years, Linux machines have become a more and more prominent target for all sorts of threat actors. According to our telemetry, 260,000 unique Linux samples appeared in the first...

Siemens QMS Automotive 安全漏洞

Siemens QMS Automotive is a quality management system for the automotive industry from Siemens, Germany. A security vulnerability exists in Siemens QMS Automotive version V12.39, which stems from a lack of security controls in the affected application to prevent unencrypted communication without...

PT-2023-27752 · Macvim · Macvim

Name of the Vulnerable Software and Affected Versions: Macvim versions prior to 178 Description: The issue is related to an insecure interprocess communication IPC mechanism in Macvim, a text editor for MacOS. This mechanism could lead to a privilege escalation. Distributed objects, a concept...

PT-2023-5185 · Unknown · Qms Automotive

Name of the Vulnerable Software and Affected Versions: QMS Automotive versions prior to V12.39 Description: A vulnerability has been identified in the affected application, which lacks security control to prevent unencrypted communication without HTTPS. This could allow an attacker who gains a...

CVE-2023-35671

In onHostEmulationData of HostEmulationManager.java, there is a possible way for a general purpose NFC reader to read the full card number and expiry details when the device is in locked screen mode due to a logic error in the code. This could lead to local information disclosure with no addition...

MAL-2023-8065 Malicious code in @get-bridge/tapestry-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bc1d41f48feb6046e7a27f7a15290bb4b1b479f102ed0d6ebd6cdc4bc89d8210 The OpenSSF Package Analysis project identified '@get-bridge/tapestry-sdk' @ 99.99.991 npm as malicious. It is considered malicious because: - T...

Malicious code in @get-bridge/bridge-string-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis e69ac01e87147a835e5ab4045ff640d7fa9d2eb636aeb12eef6e1fc1577d021f The OpenSSF Package Analysis project identified '@get-bridge/bridge-string-utils' @ 99.99.99 npm as malicious. It is considered malicious becaus...

USN-6339-3 linux-azure, linux-azure-5.15, linux-azure-fde, linux-azure-fde-5.15, linux-raspi vulnerabilities

It was discovered that the NTFS file system implementation in the Linux kernel did not properly validate MFT flags in certain situations. An attacker could use this to construct a malicious NTFS image that, when mounted and operated on, could cause a denial of service system crash. CVE-2022-48425...

DEBIAN-CVE-2023-4574

When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could have led to a use-after-free causing a potentially exploitable...

Malicious code in npm-random-gen (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e52ede67a495176f0c0e0501c905f88aca3d270ae33cea9490c1f1dfe9bcef8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mozilla: Memory corruption in IPC FilePickerShownCallback

The Mozilla Foundation Security Advisory describes this flaw as: When creating a callback over IPC for showing the File Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could...

Mozilla: Memory corruption in IPC ColorPickerShownCallback

The Mozilla Foundation Security Advisory describes this flaw as: When creating a callback over IPC for showing the Color Picker window, multiple of the same callbacks could have been created at a time and eventually all simultaneously destroyed as soon as one of the callbacks finished. This could...

Users can lost their USDY tokens in the Source Chain if something fails during the crosschain communication because there is not a validation mechanism to confirm that tokens were minted in the Destination Chain

Lines of code Vulnerability details Impact Users can lost their USDY tokens that were burnt in the Source Chain when bridging to another chain. Proof of Concept The bridging implementation solely relies and assumes that all messages sent to the Axelar Network will be validated and won't have any...