EUVD-2024-39455

Malicious code in bioql PyPI...

EUVD-2022-6780

Malicious code in bioql PyPI...

EUVD-2024-39454

Malicious code in bioql PyPI...

EUVD-2022-7716

Malicious code in bioql PyPI...

A week in security (September 8 – September 14)

Last week on Malwarebytes Labs: AI browsers or agentic browsers: a look at the future of web surfing From Fitbit to financial despair: How one woman lost her life savings and more to a scammer Meta ignored child sex abuse in VR, say whistleblowers When AI chatbots leak and how it happens Fake...

CVE-2025-42925

Due to the lack of randomness in assigning Object Identifiers in the SAP NetWeaver AS JAVA IIOP service, an authenticated attacker with low privileges could predict the identifiers by conducting a brute force search. By leveraging knowledge of several identifiers generated close to the same time,...

Cloudflare Public Bug Bounty: [Variation of #1554049] 1-Click Chaining of Self-XSS, Cookie Tossing and AntiCSRF Token Prediction leads to auto approval in Access Temp Auth

A vulnerability was discovered in Cloudflare Access that could allow for unauthorized approvals within the Temporary Auth workflow. The issue was resolved after the researcher reported it to Cloudflare...

Linux Distros Unpatched Vulnerability : CVE-2021-32278

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in faad2 through 2.10.0. A heap-buffer-overflow exists in the function ltprediction located in ltpredict.c. It allows an attacker to cau...

Linux Distros Unpatched Vulnerability : CVE-2020-1773

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An attacker with the ability to generate session IDs or password reset tokens, either by being able to authenticate or by exploiting OSA-2020-09, may be able to...

Linux Distros Unpatched Vulnerability : CVE-2016-2039

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - libraries/session.inc.php in phpMyAdmin 4.0.x before 4.0.10.13, 4.4.x before 4.4.15.3, and 4.5.x before 4.5.4 does not properly generate CSRF token values, whic...

Linux Distros Unpatched Vulnerability : CVE-2024-10603

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Weaknesses in the generation of TCP/UDP source ports and some other header values in Google's gVisor allowed them to be predicted by an external attacker in som...

Linux Distros Unpatched Vulnerability : CVE-2020-10767

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Linux kernel before 5.8-rc1 in the implementation of the Enhanced IBPB Indirect Branch Prediction Barrier. The IBPB mitigation will be...

CVE-2025-7773

The CVE-2025-7773 entry relates to Rockwell Automation ArmorBlock 5000 I/O – Web Server, specifically the 5032 16pt Digital Configurable module. The root cause is a predictable session identifier: the web server’s session number increments at an interval correlated to the last two consecutive sig...

Rockwell Automation ArmorBlock 5000 I/O - Webserver

RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to predict session numbers or perform privileged actions. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to minimize the risk of exploitation of these vulnerabilities, such as:...

Privacy Risk Predictions Based on Fundamental Understanding of Personal Data and an Evolving Threat Landscape

It is difficult for individuals and organizations to protect personal information without a fundamental understanding of relative privacy risks. By analyzing over 5,000 empirical identity theft and fraud cases, this research identifies which types of personal data are exposed, how frequently...

OSV-2025-534 Heap-use-after-free in ih264_inter_pred_luma_horz_ssse3

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428771938 Crash type: Heap-use-after-free READ 16 Crash state: ih264interpredlumahorzssse3 ih264dmotioncompensatemp isvcddecoderecontfrnmbnonbaselyr...

PT-2025-33038 · Git · Libavc

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=428771938 Crash type: Heap-use-after-free READ 16 Crash state: ih264 inter pred luma horz ssse3 ih264d motion compensate mp isvcd decode recon tfr nmb non base lyr...

When There Is No Decoder: Removing Watermarks from Stable Diffusion Models in a No-Box Setting

Watermarking has emerged as a promising solution to counter harmful or deceptive AI-generated content by embedding hidden identifiers that trace content origins. However, the robustness of current watermarking techniques is still largely unexplored, raising critical questions about their...

microcode_ctl: From CVEorg collector

A flaw was found in the Branch Prediction Unit BPU of Intel's Lion Core CPUs that make it possible for an attacker to bypass Indirect Branch Predictor Barrier IBPB protections. By employing branch predictor training techniques as described in the "Training Solo" publication, an attacker with loca...

microcode_ctl: From CVEorg collector

A flaw was found in the Branch Prediction Unit BPU of Intel's Lion Core CPUs that make it possible for an attacker to bypass Indirect Branch Predictor Barrier IBPB protections. By employing branch predictor training techniques as described in the "Training Solo" publication, an attacker with loca...