How Microsoft Purview and Priva support the partner ecosystem

Today, many enterprise organizations are multicloud and multiplatform. Critical enterprise data is located across clouds and platforms, requiring security and compliance no matter where it lives. To solve the complexity that comes with these environments, organizations have invested in multiple...

Fedora: Security Advisory for golang-github-nats-io-nkeys (FEDORA-2022-3969b64d4b)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 35 Update: golang-github-nats-io-nkeys-0.2.0-5.fc35

A public-key signature system based on Ed25519 for the NATS ecosystem...

How Shady Code Commits Compromise the Security of the Open-Source Ecosystem

In this blog entry, we discuss how open-source code has been subjected to protest-driven code modifications by its maintainers or backers. We also provide an analysis of what these incidents could mean for the IT industry and the open source community...

Private 5G Network Security Expectations Part 3

How to secure your private 5G networks; The challenge of complex ecosystem in DX...

TrickBot Gang Shifted its Focus on "Systematically" Targeting Ukraine

In what's being described as an "unprecedented" twist, the operators of the TrickBot malware have resorted to systematically targeting Ukraine since the onset of the war in late February 2022. The group is believed to have orchestrated at least six phishing campaigns aimed at targets that align...

[SECURITY] Fedora 35 Update: matrix-synapse-1.61.1-1.fc35

Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is intended to showcase the concept of Matrix and let folks see the spec in...

Fedora: Security Advisory for golang-github-nats-io-nkeys (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

Fedora: Security Advisory for golang-github-grpc-ecosystem-gateway-2 (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

abstraps (0.1.8), aivm (>=0.2.0, <=0.3.0) +287 more potentially affected by CVE-2022-31104 via cranelift-codegen (>=0.14.0, <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-31104 Source advisory: OSV:GHSA-JQWC-C49R-4W2X...

How to Move Your WhatsApp Chats Across Devices and Apps

It's never been easier to switch between iPhone and Android—and to get your messages out of the Meta ecosystem entirely...

magnirepudiandae (>=1.0.0, <=1.2.0), temporibusbeatae (>=1.0.0, <=1.3.1) +2 more potentially affected by unknown CVE via metamask (0.0.1-security)

metamask NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on metamask and may be impacted: - magnirepudiandae =1.0.0, =1.0.0, =1.1.2, =1.1.3 Source cves: unknown CVE Source advisory: OSV:MAL-2022-4571...

abstract-boot (>=0.2.0-beta.4, <=0.2.0-beta.7), ace-test-lib (0.1.0) +711 more potentially affected by unknown CVE via rust-crypto (0.2.36)

rust-crypto CARGO version 0.2.36 is affected by a known vulnerability. The following packages have a transitive dependency on rust-crypto and may be impacted: - abstract-boot =0.2.0-beta.4, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.8.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more...

@3dlook/camera (>=2.1.0, <=2.2.0), @activescott/cookieconsent (>=1.0.0-beta.2, <=4.0.6) +408 more potentially affected by CVE-2022-31051 via semantic-release (>=17.0.4, <=19.0.2)

semantic-release NPM version =17.0.4, =2.1.0, =1.0.0-beta.2, =2.3.0, =1.0.0, =1.2.0, =1.0.0, =1.0.0, =2.1.2, =1.0.1, =3.0.0, =1.0.0, =1.33.1, =1.0.27, =1.0.29, =1.0.36 and more Source cves: CVE-2022-31051 Source advisory: OSV:GHSA-X2PG-MJHR-2M5X...

abc (>=0.1.0, <=0.2.3), aerospike (>=0.0.1, <=1.3.0) +314 more potentially affected by unknown CVE via crossbeam (>=0.1.6, <=0.2.12)

crossbeam CARGO version =0.1.6, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.4.0, =0.0.6, =0.0.9 - bio 0.3.13 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RWF4-GX62-RQFW...

@1023-ventures/serra-common (>=0.3.31, <=0.3.33), @2600hz/sds-react-native-components (>=0.1.0, <=1.8.1) +1999 more potentially affected by CVE-2021-24037 via hermes-engine (>=0.0.0, <=0.7.2)

hermes-engine NPM version =0.0.0, =0.3.31, =0.1.0, =0.6.0-alpha.1, =1.0.0, =1.0.1, =0.0.1, =0.0.1, =3.0.0, =0.1.0, =10.2.0-alpha.0, =12.0.3-alpha.1, =1.0.4, =0.0.1, =0.0.4 and more Source cves: CVE-2021-24037 Source advisory: OSV:GHSA-MPH8-6787-R8HW...

@airy/maleo (>=0.1.0, <=0.3.1-canary.36), @ardatan/graphql-to-config-schema (>=0.1.19, <=0.1.20) +50 more potentially affected by CVE-2022-1650 via eventsource (>=1.0.1, <=1.1.0)

eventsource NPM version =1.0.1, =0.1.0, =0.1.19, =1.1.1, =0.6.0-beta-1, =2.0.1-alpha.18, =4.1.1-alpha-0188b2d.0, =0.4.5-alpha-4d4e438.0, =0.0.5-alpha-cc593a47.0, =0.8.2-alpha-4c2d524a.0, =0.5.2, =0.0.1, =0.0.1, =6.2.8-alpha-006f5787.0, =6.5.1-alpha-3f7e98ee.0, =6.10.0-alpha-a4628cc4.0 -...

malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

Anker Eufy Homebase 2 libxm_av.so DemuxCmdInBuffer buffer overflow vulnerability

Talos Vulnerability Report TALOS-2022-1480 Anker Eufy Homebase 2 libxmav.so DemuxCmdInBuffer buffer overflow vulnerability May 5, 2022 CVE Number CVE-2022-26073 SUMMARY A denial of service vulnerability exists in the libxmav.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h. A...

Over 50 countries sign the “Declaration for the Future of the Internet”

Governments of the US, EU member states, and 32 other countries have announced the launch of the "Declaration for the Future of the Internet," a "political commitment" among endorsers "to advance a positive vision for the internet and digital technologies." "We are united by a belief in the...