MAL-2023-7345 Malicious code in tppinghackedpaypal (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx bd0cb3c5b450307834ff52807883f3af3ef67289be5c025383dc5644143b93c4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5968 Malicious code in selfcontroledintel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ea9d18c4e891130d149a99fdde160834d53f3c33789d2e771d40245b33c943b7 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7487 Malicious code in tppywloadhydra (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx f591f3b48488f01d199518319b5967a224876e77f0202158297551519153b34b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7252 Malicious code in tpmaskvisacontrol (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b41b39ff471852208bd4891aead33592018aaac7b42752f0359c638e71e17cbf EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in py-pywvisahydra (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ab59bbf5db4a3372b2a56c8f2d70af10839c3d5e4e7278ead807ed7d07df0e8f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2746 Malicious code in esqcandyosintcandy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx efee5266049ae65f045ee5e7757635552fd870648619564a20328bab9038e7f8 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6640 Malicious code in selfstringpullpush (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 2e76f7505f1e0feeae6a6f20c29706b28f3039749673317bf8dc820239b11fb3 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-6082 Malicious code in selfgamepypost (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx b752d0d154d23b39a06208732e66acc078f25853c4e8773d6810722a5518d98a EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-3905 Malicious code in libcontrolhttpstr (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ec54d33b4978cf8aeb5ed3e67dbc5b622f0765d0812587bb826940a7ea1aa67f EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices

A pair of serious security defects has been disclosed in the Trusted Platform Module TPM 2.0 reference library specification that could potentially lead to information disclosure or privilege escalation. One of the vulnerabilities, CVE-2023-1017 , concerns an out-of-bounds write, while the other,...

New Flaws in TPM 2.0 Library Pose Threat to Billions of IoT and Enterprise Devices

A pair of serious security defects has been disclosed in the Trusted Platform Module TPM 2.0 reference library specification that could potentially lead to information disclosure or privilege escalation. One of the vulnerabilities, CVE-2023-1017, concerns an out-of-bounds write, while the other,...

New MQsTTang Backdoor from Mustang Panda Targets Political and Governmental Organizations

Threat Level Attack Report Follow Hive Pro for a detailed threat advisory, download the pdf file here from HiveForce Labs. Summary A new custom backdoor called MQsTTang, which they attribute to the Mustang Panda APT group. This backdoor is part of an ongoing campaign that began in early January...

Malicious code in esqpepintpyw (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 368fe1092720900811040e8a04fb59f08fb55eec4e4d33881fee139afe8d7ba0 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-4490 Malicious code in librereplacereplace (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx ed5f0755a7800e998ae73116017f01e08d7ac92b669ce4157d879508b3faae8b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-5707 Malicious code in py-ultrageturl (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 01930305a64fa02060ad5c305f01da7c89a1a0d944c7425354d0dc3a43f8d737 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Malicious code in tppylgtbnvidia (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 902f6b3dd565bb41847f637f72fe2dd7c288d9b3e814758143c6147aab78b456 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7476 Malicious code in tppyrandomed (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7ae4f35f4b62a39c439b16d5a81eb24398dc404bb527e2543e524bfc543da367 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-7664 Malicious code in tptoolpywgui (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 13ae482293b38eb9a03870f3e171704aa0f874d8bd2d844f29b891e26bee00f7 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

Kubernetes vulnerable to path traversal

Users authorized to list or watch one type of namespaced custom resource cluster-wide can read custom resources of a different type in the same API group without authorization. Clusters are impacted by this vulnerability if all of the following are true: 1. There are 2+ CustomResourceDefinitions...

CVE-2023-25173

A flaw was found in containerd, where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some...