Aggregator
CVE-2022-43680 | libexpat up to 2.4.9 XML_ExternalEntityParserCreate use after free (Issue 649 / Nessus ID 211295)
CVE-2022-43680 | Oracle Middleware Common Libraries and Tools 12.2.1.4.0 Centralized Third-party Jars denial of service (Nessus ID 211295)
阿迪达斯曝数据泄露事件,NASA开源软件发现安全漏洞|一周特辑
CVE-2021-44529 | Ivanti EPM Cloud Services Appliance code injection (SA-2021-12-02 / EDB-50833)
CVE-2000-0465 | Microsoft Internet Explorer 4.0/4.0.1/5.0/5.0.1 Frame DocumentComplete privileges management (MS00-033 / EDB-19939)
Hackers Drop Info-Stealing Malware On TikTok Users Device Using AI-Generated Videos
Cybercriminals have weaponized artificial intelligence to create sophisticated social engineering attacks on TikTok, using AI-generated tutorial videos to distribute dangerous information-stealing malware that has already reached hundreds of thousands of users across the platform. Threat actors are exploiting TikTok’s massive user base by creating convincing AI-generated videos that masquerade as legitimate software tutorials, specifically targeting […]
The post Hackers Drop Info-Stealing Malware On TikTok Users Device Using AI-Generated Videos appeared first on Cyber Security News.
DoD Cyber Clause Flowdown: What Suppliers Must Do
The Department of Defense DFARS Cybersecurity Clause, more commonly known as the DoD Cyber Clause (or just DFARS 7012), is the long-standing set of rules the DoD has put in place for all members of the DoD supply chain and defense industrial base. It has also spread beyond those boundaries through the use of DFARS […]
The post DoD Cyber Clause Flowdown: What Suppliers Must Do appeared first on Security Boulevard.
CVE-2004-1955 | phProfession 2.5 modules.php offset sql injection (EDB-24034 / XFDB-15932)
粽叶飘香五月五 浓情端午共安康
Weaponized PyPI Package Steals Solana Private Keys Via Supply Chain Attack
A sophisticated supply chain attack targeting Solana developers has compromised over 25,900 downloads through a weaponized Python package that silently steals cryptocurrency private keys during routine development workflows. The malicious campaign, centered around a package called “semantic-types,” represents a new evolution in software supply chain threats by leveraging transitive dependencies and blockchain-based exfiltration methods to […]
The post Weaponized PyPI Package Steals Solana Private Keys Via Supply Chain Attack appeared first on Cyber Security News.