Rogue Developer Infects Widely Used NodeJS Module to Steal Bitcoins

A widely used third-party NodeJS module with nearly 2 million downloads a week was compromised after one of its open-source contributor gone rogue, who infected it with a malicious code that was programmed to steal funds stored in Bitcoin wallet apps. The Node.js library in question is...

Rogue Developer Infects Widely Used NodeJS Module to Steal Bitcoins

A widely used third-party NodeJS module with nearly 2 million downloads a week was compromised after one of its open-source contributor gone rogue, who infected it with a malicious code that was programmed to steal funds stored in Bitcoin wallet apps. The Node.js library in question is...

Malicious Cryptocurrency Theft

[email protected] is a malicious package. The package displays malicious activities when imported from event-stream, and when used with cryptocurrenty related libraries such as copay-dash where the malicious code in flatmap-stream steals "hot" wallet profiles that were stored from mobile apps,...

GLSA-201811-19 : Libav: Multiple vulnerabilities

The remote host is affected by the vulnerability described in GLSA-201811-19 Libav: Multiple vulnerabilities Multiple vulnerabilities have been discovered in Libav. Please review the CVE identifiers referenced below for details. Impact : A remote attacker, via a crafted Smacker stream, could caus...

Critical severity vulnerability that affects event-stream and flatmap-stream

The NPM package flatmap-stream is considered malicious. A malicious actor added this package as a dependency to the NPM event-stream package in version 3.3.6. Users of event-stream are encouraged to downgrade to the last non-malicious version, 3.3.4, or upgrade to the latest 4.x version. Users of...

GHSA-MH6F-8J2X-4483 Critical severity vulnerability that affects event-stream and flatmap-stream

The NPM package flatmap-stream is considered malicious. A malicious actor added this package as a dependency to the NPM event-stream package in version 3.3.6. Users of event-stream are encouraged to downgrade to the last non-malicious version, 3.3.4, or upgrade to the latest 4.x version. Users of...

Malicious Package

Overview Version 0.1.1 of flatmap-stream is considered malicious. This module runs an encrypted payload targeting a very specific application, copay and because they shared the same description it would have likely worked for copay-dash. The injected code: - Read in AES encrypted data from a file...

Node.js third-party modules: flatmap-stream malicious package (distributed via the popular events-stream)

I would like to report a case of malicious package flat-stream that made it's way into many other npm packages. One such popular package is event-stream user dominictarr transferred the ownership of an npm module to another user because he wasn't actively maintaining it. That user then added...

Debian DSA-4343-1 : liblivemedia - security update

It was discovered that a buffer overflow in liveMedia, a set of C++ libraries for multimedia streaming could result in the execution of arbitrary code when parsing a malformed RTSP stream. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from...

Ford Eyes Using Personal Data to Boost Profits

UPDATE Ford Motor Company is known for making cars and trucks; but the future for the iconic automaker might look a little more like Facebook than an assembly line. As it struggles with hemorrhaging earnings in markets outside of North America, industry-watchers are speculating that Ford is looki...

XML Containing Malicious File Stream

Malicious files can be embedded into XML in the form of obfuscated file streams. A remote attacker can exploit this to transfer malicious files into a user's machine. Successful exploitation would allow an attacker to execute arbitrary code...

Google Android Buffer Overflow Vulnerability (CNVD-2019-27583)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA. A buffer overflow vulnerability exists in the ixheaacdchannel.c file of ixheaacdindividualchstream in Android version 9, which stems from a lack of boundary checking in the progra...

SUSE-SU-2018:3769-1 Security update for MozillaThunderbird

This update for MozillaThunderbird fixes the following issues: Thunderbird 63 ESR was updated to version 60.3.0 to fix the following issues bsc1112852: Security issues fixed MFSA 2018-28: - CVE-2018-12389: Fixed memory safety bugs. - CVE-2018-12390: Fixed memory safety bugs. - CVE-2018-12391: Fix...

WordPress Flow-Flow Social Stream plugin <= 3.0.71 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found by Alaistair Jerrom-Smith in WordPress Flow-Flow Social Stream plugin versions = 3.0.71. Solution Update the WordPress Flow-Flow Social Stream plugin to the latest available version at least 3.0.72...

CVE-2018-19194

An issue was discovered in XiaoCms 20141229. /admin/index.php?c=database allows full path disclosure in a "failed to open stream" error message...

openSUSE Security Update : MozillaThunderbird (openSUSE-2018-1340)

This update for MozillaThunderbird fixes the following issues : Thunderbird 63 ESR was updated to version 60.3.0 to fix the following issues bsc1112852 : Security issues fixed MFSA 2018-28 : - CVE-2018-12389: Fixed memory safety bugs. - CVE-2018-12390: Fixed memory safety bugs. - CVE-2018-12391:...

Poppler Reachable Abort Vulnerability

Poppler is based on xpdf-3.0 code base PDF rendering library. A reachable abort vulnerability exists in Object.h in Poppler 0.71.0, which stems from a lack of stream checking in EmbFile::save2 in FileSpec.cc before saving an embedded file, which can be exploited by an attacker to cause a denial o...

Foscam Opticam i5 Information Disclosure Vulnerability

Foscam Opticam i5 is an IP camera from FOSCAM. An information disclosure vulnerability exists in the Foscam Opticam i5 with system firmware 1.5.2.11 and application firmware 2.21.1.128. The vulnerability stems from a response to an ONVIF media GetStreamUri request containing an administrator...

CVE-2018-19078

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The response to an ONVIF media GetStreamUri request contains the administrator username and password...

Code injection

An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file...