Malicious code in @lottiefiles/lottie-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security faa879b0fa360852899250846599b4b81d442b942d5e4fec4101044400272af1 The NPM package @lottiefiles/lottie-player had unauthorized new versions published that contained malicious code. The malicious code...

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data

A new set of malicious packages has been unearthed in the Python Package Index PyPI repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust...

New PyPI Malware Poses as Crypto Wallet Tools to Steal Private Keys

Checkmarx researchers discovered PyPI malware posing as crypto wallet tools. These malicious packages stole private keys and recovery…...

How Researchers Cracked an 11-Year-Old Password to a $3 Million Crypto Wallet

Thanks to a flaw in a decade-old version of the RoboForm password manager and a bit of luck, researchers were able to unearth the password to a crypto wallet containing a fortune...

Cuckoo Mac Malware Mimics Music Converter to Steals Passwords and Crypto

By Deeba Ahmed Cuckoo malware targets macOS users, stealing passwords, browsing history, crypto wallet details & more. Disguised as a music converter, it poses a major security risk. Learn how to protect yourself from this sophisticated infostealer. This is a post from HackRead.com Read the...

Step-by-Step Guide to Creating Your First Crypto Wallet

By Owais Sultan Entering the dynamic world of cryptocurrencies is pretty exciting. But one can easily get overwhelmed with the amount… This is a post from HackRead.com Read the original post: Step-by-Step Guide to Creating Your First Crypto Wallet...

WordPress Web3 – Crypto wallet Login & NFT token gating Plugin < 3.0.0 is vulnerable to Broken Authentication

Software Web3 – Crypto wallet Login & NFT token gating Type Plugin Vulnerable versions 3.0.0 Fixed in 3.0.0 OWASP Top 10 A2: Broken Authentication Classification Broken Authentication CVE CVE-2023-6036 Patch priority Low CVSS severity Low 9.8 Developer Claim ownership PSID 9bc7bba9b677 Credits...

Malicious PyPI Packages Slip WhiteSnake InfoStealer Malware onto Windows Machines

Cybersecurity researchers have identified malicious packages on the open-source Python Package Index PyPI repository that deliver an information stealing malware called WhiteSnake Stealer on Windows systems. The malware-laced packages are named nigpal, figflix, telerer, seGMM, fbdebug, sGMM,...

Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass

Description The plugin is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handleauthrequest' and 'hadleloginrequest'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an...

Web3 – Crypto wallet Login & NFT token gating < 3.0.0 - Authentication Bypass

Description The plugin is vulnerable to an authentication bypass due to incorrect authentication checking in the login flow in functions 'handleauthrequest' and 'hadleloginrequest'. This makes it possible for non authenticated attackers to log in as any existing user on the site, such as an...

Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach

In November 2022, the password manager service LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people...

Design/Logic Flaw

Crypto wallets implementing the GG18 or GG20 TSS protocol might allow an attacker to extract a full ECDSA private key by injecting a malicious pallier key and cheating in the range proof. Depending on the Beta parameters chosen in the protocol implementation, the attack might require 16 signature...

CVE-2023-33242 Lindell17 TSS Abort Mishandling

Crypto wallets implementing the Lindell17 TSS protocol might allow an attacker to extract the full ECDSA private key by exfiltrating a single bit in every signature attempt 256 in total because of not adhering to the paper's security proof's assumption regarding handling aborts after a failed...

FakeTrade Android Malware Attack Steals Crypto Wallet Data

By Deeba Ahmed Dubbed CherryBlos and FakeTrade by researchers, these two malware campaigns have been identified as potentially related by Trend Micro. This is a post from HackRead.com Read the original post: FakeTrade Android Malware Attack Steals Crypto Wallet Data...

CVE-2023-3249

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...

CVE-2023-3249

The WordPress plugin Web3 – Crypto wallet Login & NFT token gating (Web3 authentication) is affected by CVE-2023-3249. Affected versions up to and including 2.6.0 suffer an authentication bypass due to an incorrect check in the hidden_form_data routine, allowing an authenticated attacker to log i...

CVE-2023-3249 Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication Bypass

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...

CVE-2023-3249

The Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hiddenformdata' function. This makes it possible for authenticated attackers to log in as...

WordPress Plugin Web3 – Crypto wallet Login & NFT token gating 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress Plugin Web3 - Crypto wall...

WordPress Web3 – Crypto wallet Login & NFT token gating Plugin <= 2.6.0 is vulnerable to Bypass Vulnerability

Software Web3 – Crypto wallet Login & NFT token gating Type Plugin Vulnerable versions = 2.6.0 Fixed in 2.7.0 OWASP Top 10 A2: Broken Authentication Classification Bypass Vulnerability CVE CVE-2023-3249 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 137db20e70bb Credits...