FTC Fines Fortnite Maker Epic Games $275 Million for Violating Children's Privacy Law

Epic Games has reached a $520 million settlement with the U.S. Federal Trade Commission FTC over allegations that the Fortnite creator violated online privacy laws for children and tricked users into making unintended purchases in the video game. To that end, the company will pay a record $275...

A week in security (December 5 - 11)

Last week on Malwarebytes Labs: Security advisories are falling short. Here's why, with Dustin Childs: Lock and Code S03E25 Eufy "no cloud" security cameras streaming data to the cloud Snapchat gives Californians more power over their personal data Update now! Emergency fix for Google Chrome's V8...

Configure Virtual Channel Allow List for Epic Slingshot and Epic Warp Drive

The Virtual Channel Allow List feature has been enabled by default as of CVAD 2109 and has been carried forward to CVAD 2203 LTSR. When the allow list is enabled, Epic Slingshot and Epic Warp Drive require configuration of the Virtual Channel Allow List for their associated virtual channels to...

Malicious Package

Overview epic-ue-marketo is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package w...

Malicious Package

Overview epic-ue-search is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package wa...

Malicious code in epic-ue-loading (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d044e670b4e25808611fceec6e531cf961c66589e41ffb8c8c4894a5b6c868b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2771 Malicious code in epic-ue-loading (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d044e670b4e25808611fceec6e531cf961c66589e41ffb8c8c4894a5b6c868b2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-27935

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth...

CVE-2022-27935

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth...

CVE-2022-27935

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth...

Code injection

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth...

CVE-2022-27935

Pexip Infinity before 27.3 allows remote attackers to trigger a software abort via Epic Telehealth...

CVE-2022-27935

Pexip Infinity before 27.3 is affected. The vulnerability allows remote attackers to trigger a software abort via Epic Telehealth, caused by an input validation issue in the affected versions. Impact is described as a potential denial/abort condition rather than data exfiltration. Remediation: up...

PT-2022-18703 · Pexip · Pexip Infinity

Name of the Vulnerable Software and Affected Versions: Pexip Infinity versions prior to 27.3 Description: The issue allows remote attackers to trigger a software abort via Epic Telehealth. Recommendations: For versions prior to 27.3, update to version 27.3 or later to resolve the issue...

Malicious Package

Overview epic-fortnite-webpack-config is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if...

Malicious Package

Overview epic-fortnite-shared-values is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if th...

Malicious Package

Overview epic-am-observer-store is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious Package

Overview epic-am-ui is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview epic-am-types is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package was...

Malicious Package

Overview epic-am-constants is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this package...