A flaw in the binary-parser npm package before version 2.3.0 lets attackers execute arbitrary JavaScript via unsanitized parser input.

This newsletter compiles the latest SEI releases and news about the CERT UEFI Parser for inspecting firmware, webcasts on right-sized DevSecOps and on the Software Acquisition Pathway, SEI appearances ...

The bug allows attackers to carry out XML External Entity (XXE) injection attacks via crafted XFA files inside PDF files. A critical-severity vulnerability in the Apache Tika open source analysis ...

There is a lot of enterprise data trapped in PDF documents. To be sure, gen AI tools have been able to ingest and analyze PDFs, but accuracy, time and cost have been less than ideal. New technology ...

A critical vulnerability in the popular expr-eval JavaScript library, with over 800,000 weekly downloads on NPM, can be exploited to execute code remotely through maliciously crafted input. The ...

The police agency issued a press release shortly before noon, stating that the library had been evacuated as a precautionary measure. At 12:15 p.m., police announced Lenape Way will be closed from ...

PDF Agile Offers OCR, Editing, and Annotations in One User-Friendly Package This all-in-one solution is built to handle the common frustrations of PDF work, and it's on sale now.

18 popular NPM packages with over 2 billion weekly downloads were compromised through a phishing attack targeting developer “Qix” The malware functioned as a “crypto-clipper,” silently replacing ...

The breach hit core JavaScript libraries such as chalk and strip-ansi, downloaded billions of times each week, raising alarms over the security of open-source software. Hackers have compromised widely ...

NPM developer qix's account compromise potentially puts user funds at risk by compromising library dependencies used by bitcoin wallets. A major NPM developer, qix, has had their account compromised.

A new malicious npm package impersonating the widely used nodemailer library has been uncovered by cybersecurity researchers. The package, named “nodejs-smtp,” not only functioned as an email sender ...