Third-party code

Supply chain attacks possible with TensorFlow CI/CD misconfigurations TensorFlow instances on GitHub and PyPi could have been subjected to supply chain attacks involving the exploitation of continuous integration and continuous delivery vulnerabilities within the open-source machine learning framework, reports The Hacker News.

BleepingComputer reports that more than 6,700 WordPress sites leveraging Popup Builder plugin vulnerable to the cross-site scripting bug, tracked as CVE-2023-6000, have been compromised in a new Balada Injector campaign that commenced last month.

Could threat actors leverage “dependency hell” to exploit open-source software repositories?

Healthcare security came under scrutiny in 2023, and supply-chain attacks became all too common.

More than 15,000 Go module repositories on GitHub accounting for at least 800,000 Go module variants could be compromised in repojacking attacks, The Hacker News reports.

More than 20 new vulnerabilities, including one critical vulnerability, enable denial-of-service attacks, remote code execution and more.

Numerous Web3 smart contracts, including DropERC20, AirDrop20, ERC721, and ERC1155, were discovered by Thirdweb to be exposed to a vulnerability in a widely used open-source nonfungible token library, reports SiliconAngle.