`tree-sitter-pkl` was removed from crates.io for malicious code

tree-sitter-pkl was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in March 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

RHSA-2024:4057

creationtimestamp| type| source ---|---|--- 2025-03-06 15:10:49+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/6677 2025-03-26 19:26:07+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/8934 2025-05-08 12:24:12+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/15516...

CVE-2025-27590

creationtimestamp| type| source ---|---|--- 2025-03-03 04:29:48+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/6146 2025-03-03 05:48:30+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114096924924188445 2025-03-03 06:00:40+00:00|...

FBI, Europol, and NCA Take Down 8Base Ransomware Data Leak and Negotiation Sites

--- Source: The Nation A coordinated law enforcement operation has taken down the dark web data leak and negotiation sites associated with the 8Base ransomware gang. Visitors to the data leak site are now greeted with a seizure banner that says: "This hidden site and the criminal content have bee...

CVE-2024-0765

As a default user on a multi-user instance of AnythingLLM, you could execute a call to the /export-data endpoint of the system and then unzip and read that export that would enable you do exfiltrate data of the system at that save state. This would require the attacked to be granted explicit acce...

RUSTSEC-2025-0158 `jfrog_quotes` was removed from crates.io for malicious code

jfrogquotes was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in January 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

`custom-req-on-workers` was removed from crates.io for malicious code

custom-req-on-workers was part of a campaign that attempted to exfiltrate environmental data from the host. The malicious crate had 1 version published in January 2025, and had no evidence of actual usage. This crate had no dependencies on crates.io...

How to secure body-worn cameras and protect footage from cyber threats

TL;DR Body-worn cameras are used by police and other security personnel Cameras are taken into the field but footage could be presented as evidence Cryptographic approaches are needed to ensure the confidentiality and integrity of captured video and audio Cybersecurity challenges of body-worn...

PT-2025-1625 · Schneider Electric · Ecostruxure Power Build - Rapsody

Name of the Vulnerable Software and Affected Versions: Schneider Electric EcoStruxure Power Build Rapsody affected versions not specified Description: The issue is related to a buffer overflow vulnerability that could allow local attackers to execute arbitrary code when opening a malicious projec...

Police Dismantle Manson Market, Seize 50 Servers and 200TB Evidence

SUMMARY A day after taking down the cybercrime platform MATRIX, Europol and international law enforcement agencies have successfully…...

Europol Shuts Down Manson Market Fraud Marketplace, Seizes 50 Servers

Europol on Thursday announced the shutdown of a clearnet marketplace called Manson Market that facilitated online fraud on a large scale. The operation, led by German authorities, has resulted in the seizure of more than 50 servers associated with the service and the arrest of two suspects. More...

What NIST’s latest password standards mean, and why the old ones weren’t working

Say goodbye to the days of using the "@" symbol to mean "a" in your password or replacing an "S" with a "$." The U.S. National Institute of Standards and Technology NIST recently announced new guidelines for the ways website and organizations should handle password creation and management that wi...

UBUNTU-CVE-2021-37577

Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3 may permit an unauthenticated man-in-the-middle attacker to identify the Passkey used during pairing by reflection of a crafted public key...

CVE-2021-37577

Bluetooth LE and BR/EDR Secure Connections pairing and Secure Simple Pairing using the Passkey entry protocol in Bluetooth Core Specifications 2.1 through 5.3 may permit an unauthenticated man-in-the-middle attacker to identify the Passkey used during pairing by reflection of a crafted public key...

PT-2024-39178 · Palo Alto Networks · Pan-Os

Name of the Vulnerable Software and Affected Versions: Palo Alto Networks PAN-OS software affected versions not specified Description: A vulnerability in the GlobalProtect portal enables a malicious authenticated GlobalProtect user to impersonate another GlobalProtect user. Active GlobalProtect...

CVE-2024-45401 stripe-cli Path Traversal vulnerability

stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prior to version 1.21.3 where a plugin package containing a manifest with a malformed plugin shortname installed using the --archive-url or --archive-path flags...

PT-2024-38456 · Undefined · Undefined

Name of the Vulnerable Software and Affected Versions: No vulnerable software or affected versions specified. Description: A vulnerability candidate was withdrawn due to lack of evidence. The candidate was withdrawn by its CNA. Recommendations: At the moment, there is no information about a newer...

GO-2024-3068 Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia

Missing check for the height of cryptographic equivocation evidence in github.com/cosmos/gaia...

Cosmos Hub (Gaia): The check for the height of cryptographic equivocation evidence is missing

Summary An issue was identified in the Interchain Security ICS module that could result in the slashing of a validator for an "old" equivocation. The height-base filter for consumer equivocation evidence introduced in v2.4.0-lsm was re-enabled. Details ICS v2.4.0-lsm introduced a height-base filt...

CVE-2024-7314

anji-plus AJ-Report is affected by an authentication bypass vulnerability. A remote and unauthenticated attacker can append ";swagger-ui" to HTTP requests to bypass authentication and execute arbitrary Java on the victim server. Exploitation evidence was observed by the Shadowserver Foundation on...