Rethinking HSM and TPM Security in the Cloud: Real-World Attacks and Next-Gen Defenses

As organizations rapidly migrate to the cloud, the security of cryptographic key management has become a growing concern. Hardware Security Modules HSMs and Trusted Platform Modules TPMs, traditionally seen as the gold standard for securing encryption keys and digital trust, are increasingly...

Malicious code in @indigo-mobile/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2503d344724b3360dc4c2d74aa730e700f9555ffddba341a9d7fc88361b184a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @indigo-web/material (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 97079bfe959e2a931df0187447b063d5c5fc0998cf573097f9fb9fb36105d6a4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cleartext Storage of Sensitive Information

Overview Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information via the cert.NewLeaf function. An attacker can obtain sensitive private key material by intercepting certificates transmitted in plaintext during a TLS handshake, allowing impersonation of eith...

CVE-2025-34045 WeiPHP Path Traversal Arbitrary File Read

A path traversal vulnerability exists in WeiPHP 5.0, an open source WeChat public account platform development framework by Shenzhen Yuanmengyun Technology Co., Ltd. The flaw occurs in the picUrl parameter of the /public/index.php/material/Material/downloadimgage endpoint, where insufficient inpu...

MAL-2025-5252 Malicious code in myuscis-material (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cba011b86ceb83ee613aceb9c55a91e8aabbb2df8d473962bff0b0c55879ce49 The OpenSSF Package Analysis project identified 'myuscis-material' @...

Malicious code in myuscis-material (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis cba011b86ceb83ee613aceb9c55a91e8aabbb2df8d473962bff0b0c55879ce49 The OpenSSF Package Analysis project identified 'myuscis-material' @...

CVE-2025-5204

A vulnerability classified as problematic has been found in Open Asset Import Library Assimp 5.4.3. This affects the function MDLImporter::ParseSkinLump3DGSMDL7 of the file assimp/code/AssetLib/MDL/MDLMaterialLoader.cpp. The manipulation leads to out-of-bounds read. Attacking locally is a...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read through the MDLImporter::ParseSkinLump3DGSMDL7 function, an external file reference/strings without null terminator can allow an attacker to read data beyond the allocated buffer. Remediation There is no fixed version...

CVE-2025-48066

wire-webapp is the web application for the open-source messaging service Wire. A bug fix caused a regression causing an issue with function to delete local data. Instructing the client to delete its local database on user logout does not result in deletion. This is the case for both temporary...

CVE-2024-9024

The Material Design Icons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's mdi-icon shortcode in all versions up to, and including, 0.0.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2023-32096

Compiler removal of buffer clearing in slicryptotransparentaeadencrypttag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM...

CVE-2023-32098

Compiler removal of buffer clearing in slisesignmessage in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM...

CVE-2023-32099

Compiler removal of buffer clearing in slisesignhash in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM...

CVE-2023-32097

Compiler removal of buffer clearing in slicryptotransparentaeaddecrypttag in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM...

CVE-2023-0965

Compiler removal of buffer clearing in slicryptoacctransparentkeyagreement in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM...

CVE-2023-23773

Motorola EBTS/MBTS Base Radio fails to check firmware authenticity. The Motorola MBTS Base Radio lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secret key material, and/or leave a persistent impla...

CVE-2023-23772

Motorola MBTS Site Controller fails to check firmware update authenticity. The Motorola MBTS Site Controller lacks cryptographic signature validation for firmware update packages, allowing an authenticated attacker to gain arbitrary code execution, extract secret key material, and/or leave a...

CVE-2023-2481

Compiler removal of buffer clearing in sliseopaqueimportkey in Silicon Labs Gecko Platform SDK v4.2.1 and earlier results in key material duplication to RAM...

CVE-2021-23204

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Gallagher Command Centre Server allows OSDP key material to be exposed to Command Centre Operators. This issue affects: Gallagher Command Centre 8.40 versions prior to 8.40.1888 MR3; 8.30 versions prior to 8.30.1359 MR3...