ch.inftec.ju:ju-util-ee (>=4.1, <=4.2), com.github.marschall:osgi-remoting-ejb-jboss (0.2.0) +7 more potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.16.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.16.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - ch.inftec.ju:ju-util-ee =4.1, =3.0.39, =3.0.39, =3.0.53, =3.0.53, =7.1.83 Source cves: CVE-2020-1429...

org.jboss.as:jboss-as-ejb-client-bom (7.1.3.final), org.jboss.as:jboss-as-jms-client-bom (7.1.3.final) potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.11.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.11.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.3.final - org.jboss.as:jboss-as-jms-client-bom 7.1.3.final...

org.jboss.as:jboss-as-ejb-client-bom (7.1.0.final), org.jboss.as:jboss-as-jms-client-bom (7.1.0.final) potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.2.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.2.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.0.final - org.jboss.as:jboss-as-jms-client-bom 7.1.0.final...

org.jboss.as:jboss-as-ejb-client-bom (7.1.2.final), org.jboss.as:jboss-as-jms-client-bom (7.1.2.final) potentially affected by CVE-2020-14297 via org.jboss:jboss-ejb-client (1.0.10.final)

org.jboss:jboss-ejb-client MAVEN version 1.0.10.final is affected by a known vulnerability. The following packages have a transitive dependency on org.jboss:jboss-ejb-client and may be impacted: - org.jboss.as:jboss-as-ejb-client-bom 7.1.2.final - org.jboss.as:jboss-as-jms-client-bom 7.1.2.final...

xdlocalstorage does not verify request origin

An issue was discovered in xdLocalStorage through 2.0.5. The postData function in xdLocalStoragePostMessageApi.js specifies the wildcard as the targetOrigin when calling the postMessage function on the parent object. Therefore any domain can load the application hosting the "magical iframe" and...

org.infinispan:infinispan-as-embedded-modules (7.0.1.final), org.infinispan:infinispan-cachestore-jdbc (7.0.1.final) +26 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.0.1.final)

org.infinispan:infinispan-core MAVEN version 7.0.1.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.infinispan:infinispan-as-embedded-modules 7.0.1.final -...

org.infinispan:infinispan-as-embedded-modules (7.1.0.beta1), org.infinispan:infinispan-cachestore-jdbc (7.1.0.beta1) +26 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.1.0.beta1)

org.infinispan:infinispan-core MAVEN version 7.1.0.beta1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.infinispan:infinispan-as-embedded-modules 7.1.0.beta1 -...

com.opennewway:onw-test (1.0d11), com.opennewway:onw-web (1.0d11) +43 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (5.2.6.final)

org.infinispan:infinispan-core MAVEN version 5.2.6.final is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - com.opennewway:onw-test 1.0d11 - com.opennewway:onw-web 1.0d11 -...

org.infinispan:infinispan-as-embedded-modules (7.1.0.cr1), org.infinispan:infinispan-cachestore-jdbc (7.1.0.cr1) +26 more potentially affected by CVE-2019-10174 via org.infinispan:infinispan-core (7.1.0.cr1)

org.infinispan:infinispan-core MAVEN version 7.1.0.cr1 is affected by a known vulnerability. The following packages have a transitive dependency on org.infinispan:infinispan-core and may be impacted: - org.infinispan:infinispan-as-embedded-modules 7.1.0.cr1 -...

Insertion of Sensitive Information into Log File in Jenkins Configuration as Code Plugin

Configuration as Code Plugin logs the changes it applies to the Jenkins system log. Secrets such as passwords should be masked i.e. replaced with asterisks in that log to prevent accidental disclosure. Between Configuration as Code Plugin 0.8-alpha and 1.0, log messages contained values if the...

Malware Analysis: Trickbot

In this day and age, we are not dealing with roughly pieced together, homebrew type of viruses anymore. Malware is an industry, and professional developers are found to exchange, be it by stealing one's code or deliberate collaboration. Attacks are multi-layer these days, with diverse sophisticat...

Researchers Expose Inner Workings of Billion-Dollar Wizard Spider Cybercrime Gang

The inner workings of a cybercriminal group known as the Wizard Spider have been exposed, shedding light on its organizational structure and motivations. "Most of Wizard Spider's efforts go into hacking European and U.S. businesses, with a special cracking tool used by some of their attackers to...

Cardiologist Charged for Developing Jigsaw v.2 and Thanos Ransomware

By Deeba Ahmed The multi-tasking physician ran a Ransomware-as-a-Service and rented dangerous ransomware to cybercriminals. The US Department of Justice has unsealed a… This is a post from HackRead.com Read the original post: Cardiologist Charged for Developing Jigsaw v.2 and Thanos Ransomware...

Easy authentication and authorization in Azure Active Directory with No-Code Datawiza

This blog post is part of the Microsoft Intelligent Security Association guest blog series. Learn more about MISA. The acceleration of cloud journeys fueled by the pandemic and ever-increasing concerns about data security and information privacy have made access management one of the hottest topi...

Vaas - Verdict-as-a-Service SDKs: Analyze Files For Malicious Content

Verdict-as-a-Service VaaS is a service that provides a platform for scanning files for malware and other threats. It allows easy integration in your application. With a few lines of code, you can start scanning files for malware. ATTENTION: All SDKs are currently prototypes and under heavy...

U.S. Charges Venezuelan Doctor for Using and Selling Thanos Ransomware

The U.S. Justice Department on Monday accused a 55-year-old cardiologist from Venezuela of being the mastermind behind Thanos ransomware, charging him with the use and sale of the malicious tool and entering into profit sharing arrangements. Moises Luis Zagala Gonzalez, also known by the monikers...

new packages: hyphen-as

An update is available for hyphen-as. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky Enterpri...

new packages: hunspell-as

An update is available for hunspell-as. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Django Access Restrictions Bypass

Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...

GHSA-46X4-9JMV-JC8P Django Access Restrictions Bypass

Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...