The governance will fail to add an ecosystem token if someone creates a hToken that uses that ecosystem token

Lines of code Vulnerability details Ecosystem tokens are tokens that dont have an underlying token address in any branch and only the global representation exists. The governance adds them by calling addEcosystemToken where the ecoTokenGlobalAddress will be the Maia or Hermes token as the sponsor...

Fedora: Security Advisory for golang-github-nats-io-jwt-2 (FEDORA-2023-f122ea1b3e)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: golang-github-nats-io-nkeys-0.4.5-2.fc38

A public-key signature system based on Ed25519 for the NATS ecosystem...

GitHub Repositories Hit by Password-Stealing Commits Disguised as Dependabot Contributions

A new deceptive campaign has been observed hijacking GitHub accounts and committing malicious code disguised as Dependabot contributions with an aim to steal passwords from developers. "The malicious code exfiltrates the GitHub project's defined secrets to a malicious C2 server and modify any...

[SECURITY] Fedora 37 Update: matrix-synapse-1.80.0-5.fc37

Matrix is an ambitious new ecosystem for open federated Instant Messaging and VoIP. Synapse is a reference "homeserver" implementation of Matrix from the core development team at matrix.org, written in Python/Twisted. It is intended to showcase the concept of Matrix and let folks see the spec in...

@antgineering-studio/strapi (4.5.5), @beardeddudes/strapi-types (0.1.0) +111 more potentially affected by CVE-2023-36472 via @strapi/utils (>=4.0.0, <=4.11.6)

@strapi/utils NPM version =4.0.0, =4.11.3, =4.11.2, =1.0.0, =1.5.1 - @codeparticle/strapi 4.9.2 - @codeparticle/strapi-admin 4.9.2 - @codeparticle/strapi-data-transfer 4.9.2 - @codeparticle/strapi-database 4.9.2 - @codeparticle/strapi-generators 4.9.2 - @codeparticle/strapi-permissions 4.9.2 -...

CISA Releases its Open Source Software Security Roadmap

Today, CISA released an Open Source Software Security Roadmap to lay out—in alignment with the National Cybersecurity Strategy and the CISA Cybersecurity Strategic Plan—how we will partner with federal agencies, open source software OSS consumers, and the OSS community, to secure OSS...

ahqstore_cli_rs (>=1.0.0-rc10, <=1.0.0-rc11), algebraics (>=0.1.2, <=0.2.0) +244 more potentially affected by unknown CVE via inventory (>=0.1.10, <=0.1.11)

inventory CARGO version =0.1.10, =1.0.0-rc10, =0.1.2, =0.11.0, =0.2.0, =0.1.0, =0.6.0, =0.7.0, =0.6.0, =0.5.0, =0.6.0, =0.4.0, =0.6.0, =0.5.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0058...

Design/Logic Flaw

matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with Content-Disposition: inline upon download. This vulnerability could b...

CVE-2023-41318 Unsafe media served inline on download endpoints in matrix-media-repo

matrix-media-repo is a highly customizable multi-domain media repository for the Matrix chat ecosystem. In affected versions an attacker could upload a malicious piece of media to the media repo, which would then be served with Content-Disposition: inline upon download. This vulnerability could b...

dbs-address-space (>=0.1.0, <=0.3.0), dbs-arch (>=0.1.0, <=0.2.3) +14 more potentially affected by CVE-2023-41051 via vm-memory (>=0.4.0, <=0.11.0)

vm-memory CARGO version =0.4.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.5.0, =1.3.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0, =0.2.0, =0.3.0 and more Source cves: CVE-2023-41051 Source advisory: OSV:RUSTSEC-2023-0056...

@blinkhealth/config-yourself (>=1.0.0, <=1.0.1), @donswayo/wildduckiu (>=1.30.3, <=1.30.6) +18 more potentially affected by CVE-2023-41037 via openpgp (>=4.5.1, <=4.10.10)

openpgp NPM version =4.5.1, =1.0.0, =1.30.3, =9.0.0-dev.5644f38, =0.0.1, =1.1.6, =0.0.1, =2.0.0, =0.3.4, =0.9.0, =1.25.0, =1.31.0 and more Source cves: CVE-2023-41037 Source advisory: OSV:GHSA-CH3C-V47X-4PGP...

3d-kit (>=0.0.1, <=0.0.14), @0x4447/broccoli (>=1.0.0, <=1.0.16) +144 more potentially affected by CVE-2023-38894 via tree-kit (>=0.0.4, <=0.6.2)

tree-kit NPM version =0.0.4, =0.0.1, =1.0.0, =2.0.0, =1.0.0, =1.18.0, =0.0.1, =1.0.5-master.20190403074739, =1.0.0-master.20180909013449, =0.1.0-master.20191109234452, =0.1.0-ipcrm-custom-event.20191122150318, =1.1.0-master.20190802170815, =0.1.0-master.20190319050251,...

This Week in Spring - August 15th, 2023

SpringOne, the first in-person SpringOne since the pandemic! - is next week!! I'm so excited I could spit. And I did spit. And then, I asked ChatGPT for some help writing a poem, and it did not disappoint! T'was a week before SpringOne, in Las Vegas so grand, Where devs from all corners would soo...

armory_cli (>=0.3.3, <=0.3.28), armory_lib (>=0.1.0, <=0.3.28) +140 more potentially affected by CVE-2023-38497 via cargo (>=0.4.0, <=0.70.1)

cargo CARGO version =0.4.0, =0.3.3, =0.1.0, =0.10.0, =0.10.0, =0.1.0, =0.3.1, =0.0.1, =0.1.0, =0.1.0, =0.2.2, =0.6.0, =0.1.0, =0.1.2 and more Source cves: CVE-2023-38497 Source advisory: OSV:GHSA-J3XP-WFR4-HX87...

Part II: Implementing Effective Cyber Security Metrics that Reduce Risk Realistically

In Part I of this three-part blog series, we discussed building a cyber risk metrics program from the ground up. We also discovered how to implement effective strategies for holistically articulating your cyber risk posture across your organization. In our second installment, we’ll delve deeper...

a4 (>=0.0.1, <=0.0.4), a4-core (>=0.0.3, <=0.0.4) +979 more potentially affected by unknown CVE via atomic-polyfill (1.0.3)

atomic-polyfill CARGO version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on atomic-polyfill and may be impacted: - a4 =0.0.1, =0.0.3, =0.23.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.4.1, =0.5.2 and more Source cves: unknown...

Rapid7 Solutions for Partners

Central to our mission at Rapid7 is building long-term relationships with partners who deliver valuable security solutions to customers. As customers increasingly seek managed services to meet their security needs, we've eagerly expanded our partner ecosystem to support a rapidly growing body of...

New Ongoing Campaign Targets npm Ecosystem with Unique Execution Chain

Cybersecurity researchers have discovered a new ongoing campaign aimed at the npm ecosystem that leverages a unique execution chain to deliver an unknown payload to targeted systems. "The packages in question seem to be published in pairs, each pair working in unison to fetch additional resources...

New Ongoing Campaign Targets npm Ecosystem with Unique Execution Chain

Cybersecurity researchers have discovered a new ongoing campaign aimed at the npm ecosystem that leverages a unique execution chain to deliver an unknown payload to targeted systems. "The packages in question seem to be published in pairs, each pair working in unison to fetch additional resources...