MAL-2025-133193 Malicious code in erwin-getas40-sumpek (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e33a9bdefe74c129c65a232b3ff5b94712679e4adec587dd101070d15a6f7f5 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-124998 Malicious code in arif-klanting68-riris (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a306d69d826b718e1c799cfa6d40680a7a7c8c0be90ff8f47a82042b8499975 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-85068 Malicious code in erick-brongkos13-miaww (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7c50b31e12c5a06d4ee8ee4f43c5b85a675acea2a638f93941e9191e82424f6e This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Use of password hash with insufficient computational effort vulnerability in BUFFALO Wi-Fi router "WSR-1800AX4 series"

Overview Wi-Fi router "WSR-1800AX4 series" provided by BUFFALO INC. contains the following vulnerability. Use of password hash with insufficient computational effort CWE-916 - CVE-2025-46413 Kazuaki Chikamori and Takayuki Tatekawa of National Institute of Technology, Kochi College reported this...

nsKnox Launches Adaptive Payment Security™, Revolutionizing B2B Fraud Prevention by Solving the ‘Impossible Triangle’ of Speed, Certainty, and Effort

New York, New York, USA, 27th October 2025, CyberNewsWire...

EUVD-2022-30682

Malicious code in bioql PyPI...

PT-2025-49032

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description The Linux kernel’s DAMON virtual address space operation set implementation vaddr contains a flaw related to the pte offset map lock function within the page table walk callback. Repeate...

Use of Password Hash With Insufficient Computational Effort

Overview Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort due to the use of a simple, unsalted hash for storing user passwords and API keys. An attacker can obtain sensitive information by performing offline rainbow table attacks...

Use of Password Hash With Insufficient Computational Effort

Overview com.xuxueli:xxl-job is a distributed task scheduling framework. Affected versions of this package are vulnerable to Use of Password Hash With Insufficient Computational Effort via the XXLJOBLOGINIDENTITY in the cookie. An attacker can obtain sensitive information by exploiting weak...

Know thyself, know thy environment

Welcome to this week's edition of the Threat Source newsletter. This week, I'm coming to you from Cisco Live in San Diego where I've just talked to a room that some of you may have been in, so writing this feels a bit surreal. It's really hard to try and write a cogent newsletter with all that's...

CVE-2025-48931

The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities including rainbow tables with low computational effort...

CVE-2025-48931

The TeleMessage service through 2025-05-05 relies on MD5 for password hashing, which opens up various attack possibilities including rainbow tables with low computational effort...

CVE-2025-3937 Use of Password Hash with Insufficient Computational Effort

Use of Password Hash With Insufficient Computational Effort vulnerability in Tridium Niagara Framework on Windows, Linux, QNX, Tridium Niagara Enterprise Security on Windows, Linux, QNX allows Cryptanalysis. This issue affects Niagara Framework: before 4.14.2, before 4.15.1, before 4.10.11; Niaga...

Adaptive Wizard for Removing Cross-Tier Misconfigurations in Active Directory

Security vulnerabilities in Windows Active Directory AD systems are typically modeled using an attack graph and hardening AD systems involves an iterative workflow: security teams propose an edge to remove, and IT operations teams manually review these fixes before implementing the removal. As...

MAL-2025-2597 Malicious code in blackspammerbd1 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: oracle-using-macaron b15da26ba7f4131e44fe665d836a9cd11bec3dc1701c7c35005e468a294cd4a0 This package appears to function as a remote access tool, potentially enabling unauthorized access and facilitating data exfiltration. It seems t...

CVE-2025-2349 IROAD Dash Cam FX2 Password Hash passwd weak password hash

A vulnerability was found in IROAD Dash Cam FX2 up to 20250308. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the file /etc/passwd of the component Password Hash Handler. The manipulation leads to password hash with insufficient computational...

CVE-2025-2349

The CVE describes a vulnerability in IROAD Dash Cam FX2 (up to 20250308) affecting an unknown function in the Password Hash Handler that processes /etc/passwd. The issue leads to a password hash with insufficient computational effort. Attack requires local network access and is characterized as h...

FBI Deletes PlugX Malware from 4,250 Hacked Computers in Multi-Month Operation

The U.S. Department of Justice DoJ on Tuesday disclosed that a court-authorized operation allowed the Federal Bureau of Investigation FBI to delete PlugX malware from over 4,250 infected computers as part of a "multi-month law enforcement operation." PlugX, also known as Korplug, is a remote acce...

SUSE CVE-2024-7701

Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-toolkit: 3.6.0...

DEBIAN-CVE-2024-7701

Use of Password Hash With Insufficient Computational Effort vulnerability in percona percona-toolkit allows Encryption Brute Forcing.This issue affects percona-toolkit: 3.6.0...