CyberAlerts is shutting down on June 30th, 2025. Thank you for your support!
Threat and Vulnerability Intelligence Database
Example Searches:
CVE
Threat Actors
Countries
Vendors
Severity
Known Exploited
|
May 15th, 2025 (about 1 month ago)
|
|
Description: About a third of the case file archive of Pravosudiye — Russia's national electronic court filing system — was deleted in a previously reported cyberattack, auditors said.
A pro-Ukrainian group has claimed the intrusion.
May 15th, 2025 (about 1 month ago)
|
|
Description: Alleged Sale of Data of 500,000 Crypto Users in Spain
May 15th, 2025 (about 1 month ago)
|
|
Description: Tor has announced Oniux, a new command-line tool for routing any Linux application securely through the Tor network for anonymized network connections. [...]
May 15th, 2025 (about 1 month ago)
|
|
Description: Coinbase has disclosed a material cybersecurity breach involving insider misuse by overseas contractors, leading to unauthorized access to customer and internal company data. The breach, which the company confirmed on May 14, 2025, is linked to a credible extortion attempt demanding payment to suppress the leaked information. Coinbase, founded in 2012 and headquartered remotely with …
The post Coinbase Hit by Insider Breach and Extortion, User Data Compromised appeared first on CyberInsider.
May 15th, 2025 (about 1 month ago)
|
|
Description: Impact
Applications that use undici to implement a webhook-like system are vulnerable. If the attacker set up a server with an invalid certificate, and they can force the application to call the webhook repeatedly, then they can cause a memory leak.
Patches
This has been patched in https://github.com/nodejs/undici/pull/4088.
Workarounds
If a webhook fails, avoid keep calling it repeatedly.
References
Reported as: https://github.com/nodejs/undici/issues/3895
References
https://github.com/nodejs/undici/security/advisories/GHSA-cxrh-j4jr-qwg3
https://github.com/nodejs/undici/issues/3895
https://github.com/nodejs/undici/pull/4088
https://github.com/advisories/GHSA-cxrh-j4jr-qwg3
May 15th, 2025 (about 1 month ago)
|
|
|
Description: An issue was discovered in post.php in bootstrap-multiselect (aka Bootstrap Multiselect) 1.1.2. A PHP script in the source code echoes arbitrary POST data. If a developer adopts this structure wholesale in a live application, it could create a Reflective Cross-Site Scripting (XSS) vulnerability exploitable through Cross-Site Request Forgery (CSRF).
References
https://nvd.nist.gov/vuln/detail/CVE-2025-47204
https://github.com/projectdiscovery/nuclei-templates/commit/11e1a6c11d3954f44acfb0274b6dad4bd8045103
https://github.com/davidstutz/bootstrap-multiselect/releases
https://github.com/advisories/GHSA-gv5r-9gxr-v74w
EPSS Score: 1.01%
May 15th, 2025 (about 1 month ago)
|
|
Description: Large language models are reflections of the people who program them.
May 15th, 2025 (about 1 month ago)
|
|
|
Description: Summary
A high vulnerability exists in the Babylon protocol's x/finality module due to a lack of domain separation in signed messages, combined with insufficient validation in the MsgCommitPubRandList handler. Specifically, the handler does not enforce that the submitted Commitment field is 32 bytes long. This allows an attacker to replay a signature originally generated for a different message (e.g., a Proof-of-Possession in MsgCreateFinalityProvider) as a MsgCommitPubRandList. By crafting the message parameters, an attacker can use the typically 20-byte address bytes (from the PoP context) to form the StartHeight, NumPubRand, and a shorter-than-expected Commitment (e.g., 4 bytes). The replayed signature will pass verification for this crafted message, leading to the injection of an invalid PubRand commitment.
Impact
Successful exploitation of this vulnerability, specifically via the PoP signature replay, allows an attacker to store an invalid PubRand commitment (with a non-standard length, e.g., 4 bytes) for a targeted Finality Provider (FP). Despite the commitment itself being malformed, it's the associated StartHeight and NumPubRand (derived from the replayed address bytes and typically very large) that cause severe consequences
Future recommendations
To minimize future risk of such attacks, all finality providers should:
Never re-use your finality provider EOTS across the networks (e.g., the testnet) or for any other purpose.
Never use EOTS keys to sign any other da...
May 15th, 2025 (about 1 month ago)
|
|
|
Description: Summary
Minting large amount of tokens through ibc transfer and then depositing them in validator rewards pool (via DepositValidatorRewardsPool message) can lead to integer overflow panic when calculating cumulative_reward_ratio for the validator.
This calculation happens in x/epoching module EndBlocker, thus the panic will halt the chain.
Impact
Denial of Service - Due to panic in the EndBlocker Babylon Genesis will halt
References
https://github.com/babylonlabs-io/babylon/security/advisories/GHSA-869w-47c6-fq8q
https://github.com/advisories/GHSA-869w-47c6-fq8q
May 15th, 2025 (about 1 month ago)
|