Malicious code in my-fun-tools (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6642f3653e49e0a80b7fadf4c06bc64cba8a1a359772f1c7a668888278348fd6 During installation, the obfuscated code attempts to insert a modified Python DLL and runs a code. --- Category: MALICIOUS - The campaign has clearly malicious...

Think Your IdP or CASB Covers Shadow IT? These 5 Risks Prove Otherwise

You don’t need a rogue employee to suffer a breach. All it takes is a free trial that someone forgot to cancel. An AI-powered note-taker quietly syncing with your Google Drive. A personal Gmail account tied to a business-critical tool. That’s shadow IT. And today, it’s not just about unsanctioned...

CVE-2025-45001

react-native-keys 0.7.11 is vulnerable to sensitive information disclosure remote as encryption cipher and Base64 chunks are stored as plaintext in the compiled native binary. Attackers can extract these secrets using basic static analysis tools...

SUSE-SU-2025:20379-1 Security update for open-vm-tools

This update for open-vm-tools fixes the following issues: - Updated to 12.5.2: CVE-2025-22247: Fixed insecure file handling bsc1243106 - Fixed gcc15 compile time error bsc1241938...

CVE-2025-49273

Cross-Site Request Forgery CSRF vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through = 5.24...

Fedora 42 : uboot-tools (2025-a3561bfc13)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-a3561bfc13 advisory. Update to 2025.04 GA ---- Update to 2025.04 RC5 Tenable has extracted the preceding description block directly from the Fedora security advisory. No...

MARVEL: Multi-Agent RTL Vulnerability Extraction Using Large Language Models

Hardware security verification is a challenging and time-consuming task. For this purpose, design engineers may utilize tools such as formal verification, linters, and functional simulation tests, coupled with analysis and a deep understanding of the hardware design being inspected. Large Languag...

Improper Certificate Validation

Overview devsecops-engine-tools is a Tool for DevSecOps strategy Affected versions of this package are vulnerable to Improper Certificate Validation via the getaccesstokenclientcredentials function, which uses the requests.request function with verify=False configured. Remediation Upgrade...

Malicious code in staging-tools (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 061358db77d2084ccc01236a956a493bd28d6e2f975a14bcd9651699a3eaf352 Any computer that has this package installed or running should be considered...

MAL-2025-4765 Malicious code in staging-tools (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 061358db77d2084ccc01236a956a493bd28d6e2f975a14bcd9651699a3eaf352 Any computer that has this package installed or running should be considered...

CVE-2025-49273

Cross-Site Request Forgery CSRF vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through = 5.24...

CVE-2025-49273 WordPress WP Tools <= 5.24 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in Bill Minozzi WP Tools allows Cross Site Request Forgery. This issue affects WP Tools: from n/a through 5.24...

CVE-2025-49273

CVE-2025-49273 describes a Cross-Site Request Forgery (CSRF) flaw in the Bill Minozzi WP Tools WordPress plugin, affecting versions up to 5.24. The available documents confirm the vulnerability type and affected product but do not provide details on root-cause specifics beyond CSRF or on exploit ...

CVE-2025-49273 WordPress WP Tools plugin <= 5.24 - Cross Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF vulnerability in sminozzi WP Tools wptools allows Cross Site Request Forgery.This issue affects WP Tools: from n/a through = 5.24...

PT-2025-24217 · WordPress · Bill Minozzi Wp Tools

Name of the Vulnerable Software and Affected Versions: Bill Minozzi WP Tools versions n/a through 5.24 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability, which allows an attacker to perform unauthorized actions on a user's account. Recommendations: For Bill Minozzi WP Tool...

WordPress plugin WP Tools 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site reques...

Exploit for CVE-2025-0316

CVE-2025-0316-Exploit CVE-2025-0316 Exploit Toolkit 🚨 Auth...

Wordfence Intelligence Weekly WordPress Vulnerability Report (May 26, 2025 to June 1, 2025)

In case you missed it, Wordfence just published itsannual WordPress security report for 2024. Read it now to learn more about the evolving risk landscape of WordPress so you can keep your sites protected in 2025 and beyond. Last week, there were 65 vulnerabilities disclosed in 60 WordPress Plugin...

Ransomware hiding in fake AI, business tools

Artificial intelligence AI and small business tools are being abused as smokescreens to hit unsuspecting victims with ransomware. In the masquerade campaigns discovered by Cisco Talos, cybercriminals hid malware behind software and install packages that mimicked the websites or names of the lead...

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system for resource management allows a perpetrator to gain unauthorized access to read, update, add, and delete data.

The vulnerability of the Web Runtime SEC component of the JD Edwards EnterpriseOne Tools system relates to access control errors. Exploiting this vulnerability could allow an attacker, operating remotely, to gain unauthorized access to read, update, add, and delete data using the HTTP protocol...