AI and Political Lobbying

Launched just weeks ago, ChatGPT is already threatening to upend how we draft everyday communications like emails, college essays and myriad other forms of writing. Created by the company OpenAI, ChatGPT is a chatbot that can automatically respond to written prompts in a manner that is sometimes...

Facebook Cracks Down on Spyware Vendors from U.S., China, Russia, Israel, and India

Meta Platforms disclosed that it took down no less than 200 covert influence operations since 2017 spanning roughly 70 countries across 42 languages. The social media conglomerate also took steps to disable accounts and block infrastructure operated by spyware vendors, including in China, Russia,...

CVE-2022-2536 Transposh WordPress Translation <= 1.0.9.6 - Authorization Bypass

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient validation of settings on the 'tptranslation' AJAX action which makes it possible for...

MAL-2022-702 Malicious code in @vendavo/pezzi (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 004a318b1360c752adc4c276b1fd4e32649129a0c30bc957433d4c8f4e3710b5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Russia’s Sway Over Criminal Ransomware Gangs Is Coming Into Focus

Questions about the Kremlin’s relationships with these groups remain. But researchers are finally getting some answers...

PT-2022-5629 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to errors in the representation of information by the user interface, which can be exploited by a remote attacker to perform a spoofing attack. This c...

A Pro-China Disinfo Campaign Is Targeting US Elections—Badly

The suspected Chinese influence operation had limited success. But it signals a growing threat from a new disinformation adversary...

Pod can (likely) be chosen by miner

Lines of code Vulnerability details Impact The miner can chose pod with high probability. Proof of Concept The random number generation can be easily influenced by the miner by setting block.timestamp to within an acceptable value ranging some 10-15 consecutive values seconds. Since this is hashe...

Facebook Shuts Down Covert Political 'Influence Operations' from Russia and China

Meta Platforms on Tuesday disclosed it took steps to dismantle two covert influence operations originating from China and Russia for engaging in coordinated inauthentic behavior CIB so as to manipulate public debate. While the Chinese operation sets its sights on the U.S. and the Czech Republic,...

CVE-2022-2461 Transposh WordPress Translation <= 1.0.9.6 - Unauthorized Settings Change

The Transposh WordPress Translation plugin for WordPress is vulnerable to unauthorized setting changes by unauthenticated users in versions up to, and including, 1.0.9.6. This is due to insufficient permissions checking on the 'tptranslation' AJAX action and default settings which makes it possib...

Cross-site scripting from dynamic options in the multiselect field

Introduction Cross-site scripting XSS is a type of vulnerability that allows to execute any kind of JavaScript code inside the Panel session of the same or other users. In the Panel, a harmful script can for example trigger requests to Kirby's API with the permissions of the victim. Such...

ALPINE-CVE-2022-2625

A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure or wait for a victim to use the objec...

Pro-China Group Uses Dragonbridge Campaign to Target Rare Earth Mining Companies

A pro-China influence campaign singled out rare earth mining companies in Australia, Canada, and the U.S. with negative messaging in an unsuccessful attempt to manipulate public discourse to China's benefit. Targeted firms included Australia's Lynas Rare Earths Ltd, Canada's Appia Rare Earths &...

Application Security in 2022: Where Are We Now?

It’s always a good thing to take a step back every once in a while to take the lay of the land. Like you, we are always working at a breakneck pace to help secure the web applications being built today and ready ourselves to secure the innovations of the future. When Forrester put out The State o...

Staking: Attacker can stake very few tokens for others to increase the lock time of others' tokens.

Lines of code Vulnerability details Impact In the stake function of the Staking contract, anyone can stake tokens for others. And each time a token is staked, the lock time of all tokens is increased. This allows an attacker to stake few tokens for others to increase the lock time of others'...

MAL-2022-6180 Malicious code in smithy-typescript (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 30ca926e652a15a6d137905d2feee4fcb6145a04298503afdc22b7b71f8cef4d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-418 Malicious code in @manomano-toolbox/toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3f8ad568240473692aa6be29746503afc42eb55d6c98f814f2911c01fa046991 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Out-of-Bounds Read

libtiff.so is vulnerable to out-of-bounds read. The vulnerability exists in DECLAREwriteFunc function in tiffcp.c due to influence memory values which allows an attacker to send crated tiff file causing an application crash...

Governance Voting Dis-proportionally Favours Users Who Stake And Vote After A Poll Has Been Created And Had Its Snapshot Taken

Lines of code Vulnerability details Impact Polls are created by targeting the receivecw20 function which is queried whenever the contract receives tokens. By setting the hook message to Cw20HookMsg::CreatePoll, the sender is able to create a poll, assuming the amount sent satisfies the minimum...

Putin Warns Russian Critical Infrastructure to Brace for Potential Cyber Attacks

The Russian government on Thursday warned of cyber attacks aimed at domestic critical infrastructure operators, as the country's full-blown invasion of Ukraine enters the second day. In addition to cautioning of the "threat of an increase in the intensity of computer attacks," Russia's National...