Fedora: Security Advisory for golang-github-nats-io-nkeys (FEDORA-2022-fae3ecee19)

The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

abstraps (0.1.8), aivm (>=0.2.0, <=0.3.0) +287 more potentially affected by CVE-2022-31104 via cranelift-codegen (>=0.14.0, <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-31104 Source advisory: OSV:GHSA-JQWC-C49R-4W2X...

How to Move Your WhatsApp Chats Across Devices and Apps

It's never been easier to switch between iPhone and Android—and to get your messages out of the Meta ecosystem entirely...

magnirepudiandae (>=1.0.0, <=1.2.0), temporibusbeatae (>=1.0.0, <=1.3.1) +2 more potentially affected by unknown CVE via metamask (0.0.1-security)

metamask NPM version 0.0.1-security is affected by a known vulnerability. The following packages have a transitive dependency on metamask and may be impacted: - magnirepudiandae =1.0.0, =1.0.0, =1.1.2, =1.1.3 Source cves: unknown CVE Source advisory: OSV:MAL-2022-4571...

abstract-boot (>=0.2.0-beta.4, <=0.2.0-beta.7), ace-test-lib (0.1.0) +711 more potentially affected by unknown CVE via rust-crypto (0.2.36)

rust-crypto CARGO version 0.2.36 is affected by a known vulnerability. The following packages have a transitive dependency on rust-crypto and may be impacted: - abstract-boot =0.2.0-beta.4, =0.0.1, =0.0.1, =0.1.0, =0.0.1, =0.1.0, =0.2.0, =0.8.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.3.0 and more...

@3dlook/camera (>=2.1.0, <=2.2.0), @activescott/cookieconsent (>=1.0.0-beta.2, <=4.0.6) +408 more potentially affected by CVE-2022-31051 via semantic-release (>=17.0.4, <=19.0.2)

semantic-release NPM version =17.0.4, =2.1.0, =1.0.0-beta.2, =2.3.0, =1.0.0, =1.2.0, =1.0.0, =1.0.0, =2.1.2, =1.0.1, =3.0.0, =1.0.0, =1.33.1, =1.0.27, =1.0.29, =1.0.36 and more Source cves: CVE-2022-31051 Source advisory: OSV:GHSA-X2PG-MJHR-2M5X...

abc (>=0.1.0, <=0.2.3), aerospike (>=0.0.1, <=1.3.0) +314 more potentially affected by unknown CVE via crossbeam (>=0.1.6, <=0.2.12)

crossbeam CARGO version =0.1.6, =0.1.0, =0.0.1, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.2.0, =0.4.0, =0.4.0, =0.4.0, =0.0.6, =0.0.9 - bio 0.3.13 and more Source cves: unknown CVE Source advisory: OSV:GHSA-RWF4-GX62-RQFW...

@1023-ventures/serra-common (>=0.3.31, <=0.3.33), @2600hz/sds-react-native-components (>=0.1.0, <=1.8.1) +1999 more potentially affected by CVE-2021-24037 via hermes-engine (>=0.0.0, <=0.7.2)

hermes-engine NPM version =0.0.0, =0.3.31, =0.1.0, =0.6.0-alpha.1, =1.0.0, =1.0.1, =0.0.1, =0.0.1, =3.0.0, =0.1.0, =10.2.0-alpha.0, =12.0.3-alpha.1, =1.0.4, =0.0.1, =0.0.4 and more Source cves: CVE-2021-24037 Source advisory: OSV:GHSA-MPH8-6787-R8HW...

@airy/maleo (>=0.1.0, <=0.3.1-canary.36), @ardatan/graphql-to-config-schema (>=0.1.19, <=0.1.20) +50 more potentially affected by CVE-2022-1650 via eventsource (>=1.0.1, <=1.1.0)

eventsource NPM version =1.0.1, =0.1.0, =0.1.19, =1.1.1, =0.6.0-beta-1, =2.0.1-alpha.18, =4.1.1-alpha-0188b2d.0, =0.4.5-alpha-4d4e438.0, =0.0.5-alpha-cc593a47.0, =0.8.2-alpha-4c2d524a.0, =0.5.2, =0.0.1, =0.0.1, =6.2.8-alpha-006f5787.0, =6.5.1-alpha-3f7e98ee.0, =6.10.0-alpha-a4628cc4.0 -...

malicious crate `rustdecimal`

The Rust Security Response WG and the crates.io team were notified1 on 2022-05-02 of the existence of the malicious crate rustdecimal, which contained malware. The crate name was intentionally similar to the name of the popular rustdecimal2 crate, hoping that potential victims would misspell its...

Anker Eufy Homebase 2 libxm_av.so DemuxCmdInBuffer buffer overflow vulnerability

Talos Vulnerability Report TALOS-2022-1480 Anker Eufy Homebase 2 libxmav.so DemuxCmdInBuffer buffer overflow vulnerability May 5, 2022 CVE Number CVE-2022-26073 SUMMARY A denial of service vulnerability exists in the libxmav.so DemuxCmdInBuffer functionality of Anker Eufy Homebase 2 2.1.8.5h. A...

Over 50 countries sign the “Declaration for the Future of the Internet”

Governments of the US, EU member states, and 32 other countries have announced the launch of the "Declaration for the Future of the Internet," a "political commitment" among endorsers "to advance a positive vision for the internet and digital technologies." "We are united by a belief in the...

roaring-landmask (0.4.0) potentially affected by CVE-2022-1343 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-1343 Source advisory: OSV:RUSTSEC-2022-0027...

Here's a New Tool That Scans Open-Source Repositories for Malicious Packages

The Open Source Security Foundation OpenSSF has announced the initial prototype release of a new tool that's capable of carrying out dynamic analysis of all packages uploaded to popular open source repositories. Called the Package Analysis project, the initiative aims to secure open-source packag...

[SECURITY] Fedora 35 Update: golang-github-grpc-ecosystem-gateway-2-2.7.3-3.fc35

GRPC to JSON proxy generator following the gRPC HTTP spec...

Gold Ulrick Hackers Still in Action Despite Massive Conti Ransomware Leak

The infamous ransomware group known as Conti has continued its onslaught against entities despite suffering a massive data leak of its own earlier this year, according to new research. Conti, attributed to a Russia-based threat actor known as Gold Ulrick, is the second most prevalent malware stra...

Cloud Pentesting, Pt. 3: The Impact of Ecosystem Maturity

Now that we’ve covered the basics of cloud pentesting and the style in which a cloud environment could be attacked, let’s turn our attention to the entirety of this ecosystem. This environment isn’t too different from the on-premise ecosystem that traditional penetration testing is performed on...

Blockchains Have a ‘Bridge’ Problem, and Hackers Know It

Blockchain bridges are a crucial piece of the cryptocurrency ecosystem, which makes them prime targets for attacks...

Two Vulnerabilities affecting Apple macOS exploited-in-the-wild

THREAT LEVEL: Red For a detailed advisory, download the pdf file here Two zero-day vulnerabilities were discovered in macOS Monterey versions prior to 12.3.1. These new issues bring the total number of zero-day vulnerabilities discovered in the Apple ecosystem to four. CVE-2022-22674 is an...

Automaker Cybersecurity Lagging Behind Tech Adoption, Experts Warn

A pair of recent vulnerabilities found in the automaker ecosystem might not seem like a real danger taken separately. But experts warn a lack of attention on cybersecurity could plague “smart” car and electric vehicle systems — and users — in years to come, as the use of automotive technology...