RiptideCoin has a logic flaw vulnerability

RiptideCoin RIPT is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function of RIPT's smart contract implementation. An attacker could exploit the vulnerability to prevent the seller from accessing the assets due to the exchange...

MoneyChainNet has a flawed logic vulnerability

MoneyChainNet MCN is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function in MCN's smart contract implementation. An attacker could use this vulnerability to prevent the seller from accessing the assets due to the exchange...

GSI has a logic flaw vulnerability

GSI is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function of GSI's smart contract implementation. An attacker could exploit the vulnerability to prevent the seller from accessing the assets due to the exchange...

DestiNeed has a flawed logic vulnerability

DestiNeed DSN is an Ether-based digital currency. An integer overflow vulnerability exists in the 'sell' function in DSN's smart contract implementation. An attacker could exploit the vulnerability to prevent the seller from accessing the assets due to the exchange...

Hackers drain $25 million in assets from dForce

By Deeba Ahmed The type of attack method used by hackers is called Reentrancy. This is a post from HackRead.com Read the original post: Hackers drain $25 million in assets from dForce...

Malicious Package

Overview assets-pipeline is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using...

Malicious Package

Overview assets-offline is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using assets-offli...

Malicious Package

Overview font-assets is a malicious package. Affected versions of this package were found to be a Malicious Package, as it utilised typosquatting to run Malicious 3rd party scripts. It replaced genuine packages using an and replaced it with - and vice versa Remediation Avoid using font-assets...

XSS vectors in laminas-api-tools/api-tools

The package laminas-api-tools/api-tools bundles a number of javascript assets for purposes of providing an adminstration GUI and/or landing page. Some of these assets had reported XSS cross-site scripting vulnerabilities: Affected versions laminas-api-tools/api-tools versions prior to 1.4.1. Acti...

XSS and RCE vectors in laminas-api-tools/api-tools-documentation-swagger

The package laminas-api-tools/api-tools-documentation-swagger bundles a number of javascript assets for purposes of providing API documentation. Some of these assets had reported XSS cross-site scripting and RCE remote code execution vulnerabilities: Affected versions...

Starbucks: Minimal information disclosure of internal asset names and links which were not publicly accessible.

e4366eolywrgpidfbio discovered an application with links to internal Starbucks related resources. No public access to these resources was available, resulting in minimal information disclosure of host and resource names. @e4366eolywrgpidfbio — thank you for reporting this issue...

Forrester report for Rapid7: number juggling and an excellent overview of Vulnerability Management problems

I recently read Forrester's 20-page report "The Total Economic Impact Of Rapid7 InsightVM". It is about the Cost Savings And Business Benefits that Vulnerability Management solution can bring to the organizations. In short, I didn't like everything related to money. It seems like juggling with...

Microsoft Threat Protection stops attack sprawl and auto-heals enterprise assets with built-in intelligence and automation

Attackers will cross multiple domains like email, identity, endpoints, and applications to find the point of least resistance. Today’s defense solutions have been designed to protect, detect, and block threats for each domain separately, allowing attackers to exploit the seams and threshold...

M-Trends 2020: Insights From the Front Lines

Today we release M-Trends 2020, the 11th edition of our popular annual FireEye Mandiant report. This latest M-Trends contains all of the statistics, trends, case studies and hardening recommendations that readers have come to expect through the years—and more. One of the most exciting takeaways...

Introducing Guardicore Threat Intelligence Firewall

Guardicore’s Threat Intelligence Firewall blocks connections to malicious IPs, limiting security attack surface before reaching critical assets...

Why I joined Imperva

I’ve been in the cybersecurity industry for a couple of decades now, and the tech industry even longer. If there’s one thing I’ve learned across all my roles, it’s the value of focusing on customer experience. It sounds intuitive, right? I’m sure many of you are nodding your heads or giving me th...

Automattic: Theme Assets uploader allows HTML content

The reporter submitted a report highlighting that specially formatted yet valid HTML files were able to be uploaded as theme assets. Even though we allow for JavaScript on our blog network, we don't allow HTML files to be uploaded here so that we can restrict JavaScript execution to the blog...

Squiz Matrix CMS Arbitrary File Deletion Vulnerability

Squiz Matrix CMS is an open source content management system with a highly usable interface. An arbitrary file deletion vulnerability exists in core/assets/form/form/formquestiontypes/formquestiontypefileupload/formquestiontypefileupload.inc in Squiz Matrix CMS. An attacker can exploit this...

Unauthorized Access

silverstripe/assets is vulnerable to unauthorized access. A remote attacker is able to guess and access a filename via the AssetControlExtension due to incorrect access control for protected files uploaded via Upload::loadIntoFile...

CISA Launches “Cyber Essentials” for Small Businesses and Small SLTT Governments

The Cybersecurity and Infrastructure Security Agency CISA has launched Cyber Essentials, an effort to assist small organizations in understanding and addressing cybersecurity risks. Developed in partnership with small businesses and small state, local, tribal, and territorial SLTT governments,...