abd-clam (>=0.22.2, <=0.30.0), abrute (>=0.1.2, <=0.1.9) +2470 more potentially affected by unknown CVE via remove_dir_all (>=0.3.0, <=0.7.0)

removedirall CARGO version =0.3.0, =0.22.2, =0.1.2, =0.1.1, =0.1.0, =0.2.0, =2.1.0, =0.1.0-rc1, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0018...

Amplifying Power to Customer Through Ecosystem Integrations

Transformation to a SaaS-based cybersecurity vendor...

Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links

In what's a continuing assault on the open source ecosystem, over 15,000 spam packages have flooded the npm repository in an attempt to distribute phishing links. "The packages were created using automated processes, with project descriptions and auto-generated names that closely resembled one...

3 Steps to Automate Your Third-Party Risk Management Program

If you Google "third-party data breaches" you will find many recent reports of data breaches that were either caused by an attack at a third party or sensitive information stored at a third-party location was exposed. Third-party data breaches don't discriminate by industry because almost every...

TrickBot gang members sanctioned after pandemic ransomware attacks

In a collaborative partnership, officials in the United States and the United Kingdom unmasked and imposed financial sanctions against seven members of the notorious Russian gang TrickBot alias "TrickLoader", a mainstream banking Trojan turned malware-as-a-service MaaS platform for other criminal...

Threat Source newsletter (Feb. 9, 2023): Don't let criminals exploit your empathy

Welcome to this weeks edition of the Threat Source newsletter. Our hearts are with the people of Turkey and Syria and all those impacted by the tragic earthquake. The Cisco Foundation has launched a matching campaign to support local disaster relief organizations. As a person its always difficult...

a2 (>=0.5.0-alpha.1, <=0.5.3), aahc (0.1.0) +4871 more potentially affected by unknown CVE via tokio (>=0.2.0-alpha.1, <=1.18.2)

tokio CARGO version =0.2.0-alpha.1, =0.5.0-alpha.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.5.0, =0.1.0, =0.1.0, =0.0.1, =0.0.7-alpha.3, =0.0.7-alpha.2, =0.0.7-alpha.1, =0.0.7-alpha.3, =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:GHSA-4Q83-7CQ4-P6WG...

@aaa-backend-stack/file-storage-local (>=1.16.0, <=2.4.4), @aaa-backend-stack/file-storage-s3 (>=1.16.0, <=2.4.4) +625 more potentially affected by unknown CVE via zxcvbn (>=2.0.1, <=4.4.2)

zxcvbn NPM version =2.0.1, =1.16.0, =1.16.0, =1.16.1, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.0, =1.16.1, =1.0.0, =0.0.9, =1.7.7, =2.0.6, =0.0.5, =1.1.10, =1.16.136 and more Source cves: unknown CVE Source advisory: SNYK:JS-ZXCVBN-3257741...

Malicious Package

Amendment This was deemed not a vulnerability. Overview dtautodevweb is a malicious package. Note: This package was uncovered by one of Snyk's automated algorithms, and was since confirmed to be a proof-of-concept package uploaded by a researcher. It has been removed from the ecosystem and does n...

Microsoft Security innovations from 2022 to help you create a safer world today

The start of a new year is always a great time for reflection—to be grateful for all we have and the progress security teams have made as well as look ahead to how we can reshape the security landscape. I use this time to think about goals for the future, and to reflect on the highlights,...

Massive Ad Fraud Scheme Targeted Over 11 Million Devices with 1,700 Spoofed Apps

Researchers have shut down an "expansive" ad fraud scheme that spoofed more than 1,700 applications from 120 publishers and impacted roughly 11 million devices. "VASTFLUX was a malvertising attack that injected malicious JavaScript code into digital ad creatives, allowing the fraudsters to stack...

ani-tui (>=0.1.0, <=0.2.1), atomic-server (>=0.33.0, <=0.34.0) +107 more potentially affected by unknown CVE via kuchiki (>=0.3.4, <=0.8.1)

kuchiki CARGO version =0.3.4, =0.1.0, =0.33.0, =0.33.0, =0.7.2, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.3.0, =0.1.0, =0.8.5 - curseforgewebview 0.1.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0019...

@0x4447/broccoli (>=1.0.0, <=1.0.16), @0x4447/potato (>=2.0.0, <=2.4.7) +426 more potentially affected by CVE-2021-4299 via string-kit (>=0.0.3, <=0.11.10)

string-kit NPM version =0.0.3, =1.0.0, =2.0.0, =1.0.0, =1.18.0, =0.0.1, =0.1.0, =1.0.0, =0.1.0, =1.0.5-master.20190403074739, =1.0.0-M.5a, =0.1.0-master.20191109234452, =0.1.0-ipcrm-custom-event.20191122150318, =1.0.0-M.3, =1.2.2-master.20191206162119 - @atomist/sdm-pack-k8s...

FIN7 Cybercrime Syndicate Emerges as a Major Player in Ransomware Landscape

An exhaustive analysis of FIN7 has unmasked the cybercrime syndicate's organizational hierarchy, alongside unraveling its role as an affiliate for mounting ransomware attacks. It has also exposed deeper associations between the group and the larger threat ecosystem comprising the now-defunct...

Microsoft research uncovers new Zerobot capabilities

Botnet malware operations are a constantly evolving threat to devices and networks. Threat actors target Internet of Things IoT devices for recruitment into malicious operations as IoT devices’ configurations often leave them exposed, and the number of internet-connected devices continue to grow...

[SECURITY] Fedora 37 Update: python3.10-3.10.9-1.fc37

Python 3.10 is an accessible, high-level, dynamically typed, interpreted programming language, designed with an emphasis on code readability. It includes an extensive standard library, and has a vast ecosystem of third-party libraries. The python3.10 package provides the "python3.10" executable:...

Hackers Bombard Open Source Repositories with Over 144,000 Malicious Packages

NuGet, PyPi, and npm ecosystems are the target of a new campaign that has resulted in over 144,000 packages being published by unknown threat actors. "The packages were part of a new attack vector, with attackers spamming the open source ecosystem with packages containing links to phishing...

Pool.sol : Lack of slippage protection for swap

Lines of code Vulnerability details Impact Due to lack of slippage protection, user may suffer and incur loss of func in adverse condition. Proof of Concept Swap function is used to swap one toke for another token. While the swap function has check to ensure for exactOutput, but it does not have...

bioyino-metric (>=0.1.0, <=0.2.0), cafs (0.0.1) +29 more potentially affected by CVE-2022-46149 via capnp (>=0.0.1, <=0.12.4)

capnp CARGO version =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.5.0, =0.1.6, =0.2.8, =0.2.0, =0.17.0, =0.2.2, =0.6.0, =0.7.0 and more Source cves: CVE-2022-46149 Source advisory: OSV:GHSA-QQFF-4VW4-F6HX...

01-numacert (>=1.0.0, <=3.0.0), 10by10-react-app (1.2.1) +3849 more potentially affected by CVE-2022-24999 via qs (>=6.5.0, <=6.5.2)

qs NPM version =6.5.0, =1.0.0, =0.2.0, =0.1.0, =1.0.0, =1.0.3, =0.0.1-bate.30, =0.0.1, =0.0.1, =1.0.0, =12.1.0, =6.0.0, =7.12.0 and more Source cves: CVE-2022-24999 Source advisory: OSV:GHSA-HRPP-H998-J3PP...