@1023-ventures/serra-common (>=0.3.31, <=0.3.33), @2600hz/sds-react-native-components (>=0.1.0, <=1.8.1) +1999 more potentially affected by CVE-2021-24037 via hermes-engine (>=0.0.0, <=0.7.2)

hermes-engine NPM version =0.0.0, =0.3.31, =0.1.0, =0.6.0-alpha.1, =1.0.0, =1.0.1, =0.0.1, =0.0.1, =3.0.0, =0.1.0, =10.2.0-alpha.0, =12.0.3-alpha.1, =1.0.4, =0.0.1, =0.0.4 and more Source cves: CVE-2021-24037 Source advisory: OSV:GHSA-MPH8-6787-R8HW...

@airy/maleo (>=0.1.0, <=0.3.1-canary.36), @ardatan/graphql-to-config-schema (>=0.1.19, <=0.1.20) +50 more potentially affected by CVE-2022-1650 via eventsource (>=1.0.1, <=1.1.0)

eventsource NPM version =1.0.1, =0.1.0, =0.1.19, =1.1.1, =0.6.0-beta-1, =2.0.1-alpha.18, =4.1.1-alpha-0188b2d.0, =0.4.5-alpha-4d4e438.0, =0.0.5-alpha-cc593a47.0, =0.8.2-alpha-4c2d524a.0, =0.5.2, =0.0.1, =0.0.1, =6.2.8-alpha-006f5787.0, =6.5.1-alpha-3f7e98ee.0, =6.10.0-alpha-a4628cc4.0 -...

malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

Anker Eufy Homebase 2 libxm_av.so DemuxCmdInBuffer buffer overflow vulnerability

Talos Vulnerability Report TALOS-2022-1480 Anker Eufy Homebase 2 libxmav.so DemuxCmdInBuffer buffer overflow vulnerability May 5, 2022 CVE Number CVE-2022-26073 SUMMARY A denial of service vulnerability exists in the libxmav.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h. A...

Over 50 countries sign the “Declaration for the Future of the Internet”

Governments of the US, EU member states, and 32 other countries have announced the launch of the "Declaration for the Future of the Internet," a "political commitment" among endorsers "to advance a positive vision for the internet and digital technologies." "We are united by a belief in the...

roaring-landmask (0.4.0) potentially affected by CVE-2022-1343 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-1343 Source advisory: OSV:RUSTSEC-2022-0027...

Here's a New Tool That Scans Open-Source Repositories for Malicious Packages

The Open Source Security Foundation OpenSSF has announced the initial prototype release of a new tool that's capable of carrying out dynamic analysis of all packages uploaded to popular open source repositories. Called the Package Analysis project, the initiative aims to secure open-source packag...

[SECURITY] Fedora 35 Update: golang-github-grpc-ecosystem-gateway-2-2.7.3-3.fc35

GRPC to JSON proxy generator following the gRPC HTTP spec...

Gold Ulrick Hackers Still in Action Despite Massive Conti Ransomware Leak

The infamous ransomware group known as Conti has continued its onslaught against entities despite suffering a massive data leak of its own earlier this year, according to new research. Conti, attributed to a Russia-based threat actor known as Gold Ulrick, is the second most prevalent malware stra...

Cloud Pentesting, Pt. 3: The Impact of Ecosystem Maturity

Now that we’ve covered the basics of cloud pentesting and the style in which a cloud environment could be attacked, let’s turn our attention to the entirety of this ecosystem. This environment isn’t too different from the on-premise ecosystem that traditional penetration testing is performed on...

Blockchains Have a ‘Bridge’ Problem, and Hackers Know It

Blockchain bridges are a crucial piece of the cryptocurrency ecosystem, which makes them prime targets for attacks...

Two Vulnerabilities affecting Apple macOS exploited-in-the-wild

THREAT LEVEL: Red For a detailed advisory, download the pdf file here Two zero-day vulnerabilities were discovered in macOS Monterey versions prior to 12.3.1. These new issues bring the total number of zero-day vulnerabilities discovered in the Apple ecosystem to four. CVE-2022-22674 is an...

Automaker Cybersecurity Lagging Behind Tech Adoption, Experts Warn

A pair of recent vulnerabilities found in the automaker ecosystem might not seem like a real danger taken separately. But experts warn a lack of attention on cybersecurity could plague “smart” car and electric vehicle systems — and users — in years to come, as the use of automotive technology...

@altostra/cli (>=5.15.0, <=5.15.2), @altostra/core (>=10.0.0-version-usage.0, <=10.2.0-support-aws-marketplace.2) +50 more potentially affected by CVE-2022-24066 +1 more via simple-git (>=3.0.3, <=3.4.0)

simple-git NPM version =3.0.3, =5.15.0, =10.0.0-version-usage.0, =1.1.12, =0.0.1, =1.1.1, =12.2.17, =18.2.13, =2.0.8, =1.0.3, =2.0.8, =2.0.0, =2.0.0, =1.0.3, =4.2.0 and more Source cves: CVE-2022-24066, CVE-2022-24433 Source advisory: SNYK:JS-SIMPLEGIT-2434306...

The Fragile Open Source Ecosystem Isn't Ready for 'Protestware'

A recent uptick in disruptions to open source software, including incidents aimed at objecting to Russia's war in Ukraine, have left the community on edge...

116zm_atm (1.0.0), 11_mybank (1.0.0) +209 more potentially affected by unknown CVE via faker (6.6.6)

faker NPM version 6.6.6 is affected by a known vulnerability. The following packages have a transitive dependency on faker and may be impacted: - 116zmatm 1.0.0 - 11mybank 1.0.0 - @acceleratxr/react-shared =1.1.0, =0.1.0, =1.0.0, =1.2.1, =1.1.0, =1.3.0, =1.0.0, =1.1.0, =1.2.0, =1.1.0, =1.2.0,...

0.8.18-p11 (0.8.18-p12), 0.extends.wechat (>=1.0.51, <=1.0.65) +10287 more potentially affected by CVE-2021-44906 via minimist (>=1.0.0, <=1.2.5)

minimist NPM version =1.0.0, =1.0.51, =2.3.0, =0.0.1, =1.0.0, =1.0.0, =0.0.2, =0.3.0, =0.1.0, =1.0.0, =1.0.0, =1.0.0, =1.0.14 and more Source cves: CVE-2021-44906 Source advisory: OSV:GHSA-XVCH-5GV4-984H...

Dev Sabotages Popular NPM Package to Protest Russian Invasion

The developer behind the hugely popular npm package “node-ipc” has released sabotaged versions of the library to condemn Russia’s invasion of Ukraine: a supply-chain tinkering that he’d prefer to call “protestware” as opposed to “malware.” Regardless of the peace-not-war messaging, node-ipc is no...

There is no Support For The Trading of Cryptopunks

Lines of code Vulnerability details Impact Cryptopunks are at the core of the NFT ecosystem. As one of the first NFTs, it embodies the culture of NFT marketplaces. By not supporting the trading of cryptopunks, Foundation is at a severe disadvantage when compared to other marketplaces. Cryptopunks...

A New Cybersecurity “Social Contract”

The US National Cyber Director Chris Inglis wrote an essay outlining a new social contract for the cyber age: The United States needs a new social contract for the digital age -- one that meaningfully alters the relationship between public and private sectors and proposes a new set of obligations...