CVE-2024-7747

The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when transferring funds to another user. This makes it possible for authenticated attackers, with...

CVE-2024-7747

The Wallet for WooCommerce plugin for WordPress is vulnerable to incorrect conversion between numeric types in all versions up to, and including, 1.5.6. This is due to a numerical logic flaw when transferring funds to another user. This makes it possible for authenticated attackers, with...

WordPress plugin Wallet for WooCommerce 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exist...

PT-2024-38555 · WordPress · Terawallet – For Woocommerce

Name of the Vulnerable Software and Affected Versions: Wallet for WooCommerce plugin for WordPress versions up to, and including, 1.5.6 Description: The issue arises from a numerical logic flaw when transferring funds to another user, allowing authenticated attackers with Subscriber-level access...

MAL-2024-10984 Malicious code in kraken-wallet-cryptoicons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5445e7a104fb812aa6f8ed5418680946ff853713215035b76d12e7bdd6a19300 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kraken-wallet-cryptoicons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5445e7a104fb812aa6f8ed5418680946ff853713215035b76d12e7bdd6a19300 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in kraken-wallet-network-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ac2acbbbff3feba97534f39d0555e145ac5994c2dcf5b5726f1002a09f5e6de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-10985 Malicious code in kraken-wallet-network-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9ac2acbbbff3feba97534f39d0555e145ac5994c2dcf5b5726f1002a09f5e6de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in my-wallet-backupt-decryption-tool (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 27ce6fe7581d2cdb10673965b6fefaeef4f33c8ae7f8ab0f45e5e3341065620e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

New Stealer Uses Invalid Cert To Compromise Systems

New Stealer Uses Invalid Cert To Compromise Systems By Mohinder Gill, Mallikarjun Wali and Sangram Mohapatro · November 07, 2024 A new Stealer has been making the rounds. Its name: Fickle. Fickle Stealer is a new Rust-based information stealer that spreads through various attack vectors, includin...

Malicious code in @lottiefiles/lottie-player (npm)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security faa879b0fa360852899250846599b4b81d442b942d5e4fec4101044400272af1 The NPM package @lottiefiles/lottie-player had unauthorized new versions published that contained malicious code. The malicious code...

Supply chain attack on lottie-player: everything you need to know

Supply chain attack in popular lottie-player library compromises websites with malicious Web3 wallet prompts – update or revert the library to avoid the compromised versions...

Malicious npm Packages Target Developers' Ethereum Wallets with SSH Backdoor

Cybersecurity researchers have discovered a number of suspicious packages published to the npm registry that are designed to harvest Ethereum private keys and gain remote access to the machine via the secure shell SSH protocol. The packages attempt to "gain SSH access to the victim's machine by...

Malicious code in coinbase-smart-wallet-documentation (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-9560 Malicious code in coinbase-smart-wallet-documentation (npm)

--- -= Per source details. Do not edit below this line.=-...

PyPI Repository Found Hosting Fake Crypto Wallet Recovery Tools That Steal User Data

A new set of malicious packages has been unearthed in the Python Package Index PyPI repository that masqueraded as cryptocurrency wallet recovery and management services, only to siphon sensitive data and facilitate the theft of valuable digital assets. "The attack targeted users of Atomic, Trust...

New PyPI Malware Poses as Crypto Wallet Tools to Steal Private Keys

Checkmarx researchers discovered PyPI malware posing as crypto wallet tools. These malicious packages stole private keys and recovery…...

Crypto Scam App Disguised as WalletConnect Steals $70K in Five-Month Campaign

Cybersecurity researchers have discovered a malicious Android app on the Google Play Store that enabled the threat actors behind it to steal approximately $70,000 in cryptocurrency from victims over a period of nearly five months. The dodgy app, identified by Check Point, masqueraded as the...

Malicious code in wallet-balance-notifier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d54ad3ccf5c32e9b01fe9f246e6c8136581e1e3420923ae2713221672e7279e6 The OpenSSF Package Analysis project identified 'wallet-balance-notifier' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Binance Warns of Rising Clipper Malware Attacks Targeting Cryptocurrency Users

Cryptocurrency exchange Binance is warning of an "ongoing" global threat that's targeting cryptocurrency users with clipper malware with the goal of facilitating financial fraud. Clipper malware, also called ClipBankers, is a type of malware that Microsoft calls cryware, which comes with...