COVID-19 Clinical Trials Slowed After Ransomware Attack

A ransomware attack has hit eResearchTechnology, a medical software company that supplies pharma companies with tools for conducting clinical trials – including trials for COVID-19 vaccines. The attackers could be financially motivated — or could be backed by a nation-state looking to gain...

Malicious Package in reqquest

All versions of reqquest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process...

Malicious Package in experss

All versions of experss typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process w...

Malicious Package in asyync

All versions of asyync typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...

Malicious Package in asynnc

All versions of asynnc typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the process wa...

Malicious Package in jajajejejiji

All versions of jajajejejiji typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

CVE-2020-7705

This affects the package MintegralAdSDK from 0.0.0. The SDK distributed by the company contains malicious functionality that tracks any URL opened by the app and reports it back to the company, along with performing advertisement attribution fraud. Mintegral can remotely activate hooks on the...

EFF Talks the Corporate Surveillance of Consumers

You can’t protect your privacy if you don’t know how it’s being violated. That’s the essence of a report by the Electronic Frontier Foundation that shines a bright disinfecting light on how corporations are collecting data on consumers. Think Facebook-like data collection on steroids and you begi...

data tracking utility Peekfd Segmentation Error DoS

The vulnerability of the data tracking utility’s peekfd function is caused by segmentation errors. Exploiting this vulnerability can allow an attacker to cause a service failure in the application by entering a specially crafted sequence of data in the command line...

iPhone Apps Surreptitiously Communicated with Unknown Servers

Long news article alternate source on iPhone privacy, specifically the enormous amount of data your apps are collecting without your knowledge. A lot of this happens in the middle of the night, when you're probably not otherwise using your phone: IPhone apps I discovered tracking me by passing...

Malicious Package

Overview All versions of saync typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

Malicious Package

Overview All versions of reqest typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

Malicious Package

Overview All versions of reques typosquatted a popular package of similar name and tracked users who had installed the incorrect package. The package uploaded information to a remote server including: name of the downloaded package, name of the intended package, the Node version and whether the...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), airflow-util-dv (>=1.2.1, <=1.6.2) +2 more potentially affected by CVE-2018-20244 via apache-airflow (>=1.8.2, <=1.10.1)

apache-airflow PYPI version =1.8.2, =2.4.2, =1.2.1, =1.7.2, =0.0.5, =0.0.6 Source cves: CVE-2018-20244 Source advisory: OSV:GHSA-99CV-8CVV-666C...

Apple's Shazam App Boots Facebook Ads and Other Third-Party SDKs

Shazam, the handy app that uses audio recognition to tell you what song is playing over any given set of speakers, has reportedly eliminated all third-party software developer kits SDKs in its iOS version except for one: HockeyApp. Apple, which bought the startup for $400 million last year, has...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (>=1.7.2, <=1.7.3) +1 more potentially affected by CVE-2018-20245 via apache-airflow (>=1.8.2, <=1.9.0)

apache-airflow PYPI version =1.8.2, =2.4.2, =1.7.2, =0.0.5, =0.0.6 Source cves: CVE-2018-20245 Source advisory: OSV:GHSA-77RC-X84Q-PV4F...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (>=1.7.2, <=1.7.3) +1 more potentially affected by CVE-2018-20245 via apache-airflow (>=1.8.2, <=1.9.0)

apache-airflow PYPI version =1.8.2, =2.4.2, =1.7.2, =0.0.5, =0.0.6 Source cves: CVE-2018-20245 Source advisory: GHSA-77RC-X84Q-PV4F...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2017-17835 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2017-17835 Source advisory: OSV:GHSA-68WV-RJRM-576P...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2017-17835 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2017-17835 Source advisory: GHSA-68WV-RJRM-576P...

airflow-imaging-plugins (>=2.4.2, <=2.4.3), data-tracking (1.7.2) +1 more potentially affected by CVE-2017-17836 via apache-airflow (1.8.2)

apache-airflow PYPI version 1.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on apache-airflow and may be impacted: - airflow-imaging-plugins =2.4.2, =0.0.5, =0.0.6 Source cves: CVE-2017-17836 Source advisory: OSV:GHSA-9GQG-3FXR-9HV7...