addr2line (0.7.0), aether (>=0.0.1, <=0.0.3) +358 more potentially affected by unknown CVE via parity-wasm (>=0.17.0, <=0.45.0)

parity-wasm CARGO version =0.17.0, =0.0.1, =0.1.0, =0.26.1, =0.3.10, =0.0.1, =0.0.0, =0.0.1, =0.1.0, =0.4.1, =0.1.0, =0.2.0, =0.4.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0061...

New Malware Families Found Targeting VMware ESXi Hypervisors

Threat actors have been found deploying never-before-seen post-compromise implants in VMware's virtualization software to seize control of infected systems and evade detection. Google's Mandiant threat intelligence division referred to it as a "novel malware ecosystem" that impacts VMware ESXi,...

@adobe/git-server (>=0.9.17-pre.6, <=1.0.0), @adobe/helix-cli (>=0.3.0-SNAPSHOT.293, <=5.7.6) +65 more potentially affected by CVE-2022-22984 +1 more via snyk-python-plugin (>=1.0.0, <=1.24.0)

snyk-python-plugin NPM version =1.0.0, =0.9.17-pre.6, =0.3.0-SNAPSHOT.293, =2.6.0, =1.0.5-SNAPSHOT.105, =0.0.4, =8.0.36, =5.0.22, =3.10.42, =0.0.70, =0.5.8, =3.2.4, =0.0.2, =0.0.11, =1.0.1 and more Source cves: CVE-2022-22984, CVE-2022-40764 Source advisory: SNYK:JS-SNYKPYTHONPLUGIN-3039677...

Experts Uncover 85 Apps with 13 Million Downloads Involved in Ad Fraud Scheme

As many as 75 apps on Google Play and 10 on Apple App Store have been discovered engaging in ad fraud as part of an ongoing campaign that commenced in 2019. The latest iteration, dubbed Scylla by Online fraud-prevention firm HUMAN Security, follows similar attack waves in August 2019 and late 202...

MetaMask: Possible to spoof Origin in "Connected Sites"

A vulnerability was discovered in MetaMask that allowed for the spoofing of the origin domain name in the "Connected Sites" list. This was caused by a CSS style sheet that set the direction to "right-to-left", which resulted in the order of characters in the domain name being messed up and...

hoek 安全漏洞

hoek is part of the hapi ecosystem open-sourced by hapi.js. It is designed to work seamlessly with the hapi web framework and its other components. A security vulnerability exists in hoek versions prior to 8.5.1 that stems from prototype poisoning in the clone function...

New Windows 11 security features are designed for hybrid work

Attackers are constantly evolving, becoming increasingly sophisticated and destructive—the median time for an attacker to access your private data if you fall victim to a phishing email is 1 hour, 12 minutes.1 Microsoft tracks more than 35 ransomware families and more than 250 unique nation-state...

[SECURITY] Fedora 37 Update: python3.11-3.11.0~rc2-1.fc37

Python 3.11 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries...

@dci-lint/cmd-api-server (>=0.3.0, <=0.4.0), @dci-lint/test-api-client (>=0.3.0, <=0.4.0) +46 more potentially affected by CVE-2022-36083 via jose (>=1.18.1, <=1.28.1)

jose NPM version =1.18.1, =0.3.0, =0.3.0, =0.3.0, =0.10.0-unstable.0042dcd, =0.6.1, =0.6.3, =0.6.3, =0.6.4, =0.6.3, =0.6.9, =0.6.1, =0.6.3, =0.6.3, =0.6.3, =0.6.5, =0.9.4 and more Source cves: CVE-2022-36083 Source advisory: OSV:GHSA-JV3G-J58F-9MQ9...

cargo-c (0.9.14+cargo-0.66), cargo-clone-core (0.2.0) +7 more potentially affected by CVE-2022-36113 via cargo (0.66.0)

cargo CARGO version 0.66.0 is affected by a known vulnerability. The following packages have a transitive dependency on cargo and may be impacted: - cargo-c 0.9.14+cargo-0.66 - cargo-clone-core 0.2.0 - cargo-instruments 0.4.8 - cargo-patch 0.2.9 - cargo-udeps 0.1.35 - publish-action =0.2.0, =0.1....

@appsocially/timepassport (>=0.1.2-0.1, <=0.1.29), @becompliancebr/shared-components (>=1.0.0, <=1.10.0) +80 more potentially affected by CVE-2022-25873 via vuetify (>=2.0.0, <=2.6.9)

vuetify NPM version =2.0.0, =0.1.2-0.1, =1.0.0, =1.2.5-1, =5.0.1-beta.0, =0.0.128-beta.33, =0.0.101-beta.22, =0.0.132-alpha.448, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.132-alpha.448, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.128-beta.33, =0.0.132-beta.446 and more Source cves:...

@beer-code-industry/common-frontend (>=0.5.0, <=0.7.6), @birthdayresearch/contented (1.0.1) +29 more potentially affected by CVE-2022-36046 via next (12.2.3-canary.2)

next NPM version 12.2.3-canary.2 is affected by a known vulnerability. The following packages have a transitive dependency on next and may be impacted: - @beer-code-industry/common-frontend =0.5.0, =1.0.1, =1.0.0, =1.89.0-next.89, =0.0.19, =0.0.19, =0.0.20, =0.0.44, =0.0.15, =0.0.31 -...

Microsoft is committed to the success of Java developers

Hi, Spring fans! This is a guest post from our friend Julia Liuson, President, Developer Division, Microsoft As a company, we are committed to making Java developers as efficient and productive as possible. This commitment means empowering you to use any tool, framework, and application server on...

Why the Twilio Breach Cuts So Deep

The phishing attack on the SMS giant exposes the dangers of B2B companies to the entire tech ecosystem...

2-package-manager (1.0.0), @mspguarenteed/common (1.0.4) +3 more potentially affected by unknown CVE via mongoos (0.0.1-security)

mongoos NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on mongoos and may be impacted: - 2-package-manager 1.0.0 - @mspguarenteed/common 1.0.4 - @shopappshree/common =1.0.1, =1.0.4 - calvin-2024 1.0.0 - liana-2024 1.0.0 Source...

Nearly 2,000 Signal users affected by Twilio phishing attack

New findings following the Twilio phishing attack revealed that Signal, one of its high-value clients and a popular encrypted messaging platform, was particularly affected. 1,900 of its users had their phone numbers and SMS registration codes exposed. However, Signal reassured users that the...

Introducing Malwarebytes Cloud Storage Scanning: How to scan for malware in cloud file storage repositories

Were excited to announce Malwarebytes Cloud Storage Scanning, a new service that extends Nebula malware scanning options to include files stored on cloud storage repositories that are part of your organizations digital ecosystem. Today, the service supports scanning of files under 100Mb in size...

`rustdecimal` is a malicious crate

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

MAL-2022-1 Malicious code in rustdecimal (crates.io)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2e33f42f05c60c6d9f9297bae15a43d6c445e2ad0fd67fa4ef144e5cc79d09c7 The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained...

Moderate: Red Hat Security Advisory: New container image for Red Hat Ceph Storage 5.2 Security update

A new container image for Red Hat Ceph Storage 5.2 is now available in the Red Hat Ecosystem Catalog. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...