wasmtime-cli (0.34.0) potentially affected by CVE-2022-23636 +1 more via wasmtime (0.34.0)

wasmtime CARGO version 0.34.0 is affected by a known vulnerability. The following packages have a transitive dependency on wasmtime and may be impacted: - wasmtime-cli 0.34.0 Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:GHSA-88XQ-W8CQ-XFG7...

The Unbearable Lightness of Unaudited Supply Chains

An acute need expressed by a majority of CISOs at a roundtable in Italy sparks an idea to use one of our lesser-known compliance apps to manage supply chain security assurance efforts. In the 1984 novel The Unbearable Lightness of Being, author Milan Kundera ponders the fleeting nature of man’s...

@6river/rosbag (>=1.0.2-6river, <=1.1.0-browserOrNode.2), @jamesbliss/react-flickity (>=1.0.0, <=1.4.0) +27 more potentially affected by CVE-2019-15608 via yarn (>=1.0.2, <=1.17.3)

yarn NPM version =1.0.2, =1.0.2-6river, =1.0.0, =1.9.9-1, =1.0.0, =1.0.21, =8.3.8, =0.1.0, =3.0.0, =0.0.0-semantic-release, =1.9.7, =5.0.0-ts.4, =0.0.4, =0.0.14 and more Source cves: CVE-2019-15608 Source advisory: OSV:GHSA-HJXC-462X-X77J...

Cybersecurity threats are always changing—staying on top of them is vital, getting ahead of them is paramount

With a 1,070 percent increase in ransomware attacks year-over-year between July 2020 and June 2021, staying on top of attack trends—such as ransomware and supply chain threats—is more important than ever.1 To successfully detect and defend against security threats, we need to come together as a...

Cybersecurity threats are always changing—staying on top of them is vital, getting ahead of them is paramount

With a 1,070 percent increase in ransomware attacks year-over-year between July 2020 and June 2021, staying on top of attack trends—such as ransomware and supply chain threats—is more important than ever.1 To successfully detect and defend against security threats, we need to come together as a...

A week in security (January 31 – February 6)

Last week on Malwarebytes Labs: Threat actor steals email with Zimbra zero-day FBI warns of bogus job postings on recruitment sites Investment scams are on the rise A worrying Etsy listing reveals the stalking potential of Apple’s AirTags Beware bogus OperaGX sponsorship offers $320 milllion stol...

New Argo CD Bug Could Let Hackers Steal Secret Info from Kubernetes Apps

Users of the Argo continuous deployment CD tool for Kubernetes are being urged to push through updates after a zero-day vulnerability was found that could allow an attacker to extract sensitive information such as passwords and API keys. The flaw, tagged as CVE-2022-24348 CVSS score: 7.7, affects...

Conti gang hits KP Snacks with a crippling ransomware attack

By Waqas The ransomware attack affected the supply chain and disrupted deliveries to leading supermarkets in the United Kingdom. A… This is a post from HackRead.com Read the original post: Conti gang hits KP Snacks with a crippling ransomware attack...

The Long-Term Impact of Log4j

In its aftermath, Log4j vulnerabilities put the spotlight on vendor management and supply chain security practices. Software suppliers should expect vendor security questionnaires to expand in scope and detail around application security practices. Its relatively easy for software buyers to...

KP Snacks Left with Crumbs After Ransomware Attack

KP Snacks, maker of the high-end Tyrrell’s and Popchips potato-chip brands, has suffered a ransomware attack that it said could affect deliveries to supermarkets through the end of March – at the earliest. The British company also the purveyor of deeply English treats such as Skips prawn cocktail...

Supply Chain Security Is Not a Problem…It’s a Predicament

In the late 19th century, many large cities faced an unpleasant predicament due to too much horse manure piling up in the streets. Aside from the direct impact of the odors and unsightly excrement, it indirectly poisoned the water supply and accelerated the spread of disease. There were some ways...

[updated]Cyberattack on fuel supplier causes supply chain disruption

A cyberattack has disrupted the activities in Germany of fuel supplier Oiltanking Deutschland GmbH & Co. KG. The supplier is, among others, responsible for deliveries to the thousands of Shell and Aral gas stations in Germany. The Oiltanking division of Hamburg-based Marquard & Bahls owns and...

Thousands of Malicious npm Packages Threaten Web Apps

More than 1,300 malicious packages have been identified in the most oft-downloaded JavaScript package repository used by developers, npm, in the last six months — a rapid increase that showcases how npm has become a launchpad for a range of nefarious activities. New research from open-source...

a2kit (>=0.1.0, <=2.0.6), actions-github (>=0.0.2, <=0.1.0) +683 more potentially affected by unknown CVE via json (>=0.3.4, <=0.12.4)

json CARGO version =0.3.4, =0.1.0, =0.0.2, =0.0.1, =0.1.0, =7.0.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.9.0, =1.0.0, =1.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0081...

chemicalsupply2000.com Cross Site Scripting vulnerability OBB-2353713

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

New SureMDM Vulnerabilities Could Expose Companies to Supply Chain Attacks

A number of security vulnerabilities have been disclosed in 42 Gears' SureMDM device management solution that could be weaponized by attackers to perform a supply chain compromise against affected organizations. Cybersecurity firm Immersive Labs, in a technical write-up detailing the findings, sa...

MINTING to collateralVault could inflating totalsupply, without giving the balance to anyone

Handle Tomio Vulnerability details Impact First of all, this is an address zero issue, however, this could lead to an imbalance between total supply circulating and the actual balance that was assigned to another user, in the...

CVE-2021-22813

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause arbritrary script execution when a privileged account clicks on a malicious URL specifically crafted for the NMC pointing to an edit policy file. Affected Products:...

CVE-2021-22814

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists which could cause arbritrary script execution when a malicious file is read and displayed. Affected Products: 1-Phase Uninterruptible Power Supply UPS using NMC2 including Smart-UPS,...

CVE-2021-22811

A CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability exists that could cause script execution when the request of a privileged account accessing the vulnerable web page is intercepted. Affected Products: 1-Phase Uninterruptible Power Supply UP...