OPENSUSE-SU-2024:11248-1 python36-openpyxl-3.0.7-1.2 on GA media

These are all security issues fixed in the python36-openpyxl-3.0.7-1.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11232-1 python36-impacket-0.9.23-1.2 on GA media

These are all security issues fixed in the python36-impacket-0.9.23-1.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11214-1 python36-XStatic-jquery-ui-1.12.1.1-2.11 on GA media

These are all security issues fixed in the python36-XStatic-jquery-ui-1.12.1.1-2.11 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11227-1 python36-djangorestframework-3.12.4-1.2 on GA media

These are all security issues fixed in the python36-djangorestframework-3.12.4-1.2 package on the GA media of openSUSE Tumbleweed...

Exploit for Code Injection in Ssssssss Spider-Flow

Badges !MIT Licensehttps://img.shields.io/badge/Licens...

Malicious code in requestn (PyPI)

This package is considered malicious because it extracts OS files of the localhost and sends the contents to an unknown Telegram channel...

Malicious code in tensorfioi (PyPI)

This package is considered malicious because it communicates with an unknown host via a Telegram channel...

Malicious code in Nasrtox (PyPI)

This package is considered malicious because it communicates with an unknown host via a Telegram channel...

Hackers Target Python Developers with Fake "Crytic-Compilers" Package on PyPI

Cybersecurity researchers have discovered a malicious Python package uploaded to the Python Package Index PyPI repository that's designed to deliver an information stealer called Lumma aka LummaC2. The package in question is crytic-compilers, a typosquatted version of a legitimate library named...

Malicious code in reqwestss (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 1b49654324e091538657038a1288d05e2879c02d73bec38baeae681b0a26f5b9 The OpenSSF Package Analysis project identified 'reqwestss' @ 0.1.0 pypi as malicious. It is considered malicious because: - The package...

SUSE: Security Advisory (SUSE-SU-2024:1844-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cybercriminals Abuse Stack Overflow to Promote Malicious Python Package

Cybersecurity researchers have warned of a new malicious Python package that has been discovered in the Python Package Index PyPI repository to facilitate cryptocurrency theft as part of a broader campaign. The package in question is pytoileur, which has been downloaded 316 times as of writing...

Malicious code in discord-react (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis bc34a3a31bb6498c18b917bfd0c3049006f5c630220a45dbef402db8ef290775 The OpenSSF Package Analysis project identified 'discord-react' @ 0.0.0.1 pypi as malicious. It is considered malicious because: - The package...

Researchers Uncover Flaws in Python Package for AI Models and PDF.js Used by Firefox

A critical security flaw has been disclosed in the llamacpppython Python package that could be exploited by threat actors to achieve arbitrary code execution. Tracked as CVE-2024-34359 CVSS score: 9.7, the flaw has been codenamed Llama Drama by software supply chain security firm Checkmarx. "If...

AI Python Package Flaw ‘Llama Drama’ Threatens Software Supply Chain

By Waqas The Llama Drama vulnerability in the Llama-cpp-Python package exposes AI models to remote code execution RCE attacks, enabling attackers to steal data. Currently, over 6,000 models are affected by this vulnerability. This is a post from HackRead.com Read the original post: AI Python...

SUSE: Security Advisory (SUSE-SU-2024:1667-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Huawei EulerOS: Security Advisory for python (EulerOS-SA-2024-1663)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Malicious Python Package Hides Sliver C2 Framework in Fake Requests Library Logo

Cybersecurity researchers have identified a malicious Python package that purports to be an offshoot of the popular requests library and has been found concealing a Golang-version of the Sliver command-and-control C2 framework within a PNG image of the project's logo. The package employing this...

Malicious code in multiconnections (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d080fb698cec14d7c79b82bff9f6ca58764dbfcd5b487ea88e5822e59e1d74cb The OpenSSF Package Analysis project identified 'multiconnections' @ 2.34.23 pypi as malicious. It is considered malicious because: - The packag...

AZL-40466 CVE-2024-34069 affecting package python-werkzeug for versions less than 2.3.7-2

Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, an...