5 Ways Your Software Supply Chain is Out to Get You, Part 4: Dependency Confusion

Previously, we discussed how three kinds of supply chain attack methods, Vendor Compromise, Exploit Third Party Applications, and Exploit Open Source Libraries are threatening software supply chains, passing risk downstream to the organizations and users that trust and depend on them. In this...

@reduct/build-tools (>=1.4.0 <=1.5.6), docurium-json-cleaner (>=1.0.0 <=1.0.3) +9 more potentially affected by CVE-2020-7623 via jscover (>=0.1.1 <=1.0.0)

jscover NPM version =0.1.1, =1.4.0, =1.0.0, =0.0.5, =0.0.5, =0.0.10 - latest-strong-pwd-generator =1.7.1 - print-random-console-msg =1.0.2 - random-msg-printer =1.0.0 - unique-password-suggestor =1.0.2 - unittesting =0.0.1 Source cves: CVE-2020-7623 Source advisory: SNYK:JS-JSCOVER-564250...

windows-build-tools downloads Resources over HTTP

Affected versions of windows-build-tools insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

GHSA-9P47-W5XP-F4XR windows-build-tools downloads Resources over HTTP

Affected versions of windows-build-tools insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

Windows-build-tools Code Execution Vulnerability

windows-build-tools is a tool for building native node compiled modules in Windows. A security vulnerability exists in windows-build-tools versions prior to 1.0.0, which originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker can exploit the...

RIPS Integration into Jenkins CI with Pipeline Support

Pipelines The Pipeline approach is a more developer friendly method to define the build and test process of a project. It is as easy as placing a file named Jenkinsfile into your project which contains all the configuration. This is well known from other build tools like Docker or make and improv...

CVE-2017-16003

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

CVE-2017-16003

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

Remote code execution

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

CVE-2017-16003

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

CVE-2017-16003

The CVE-2017-16003 entry affects the Windows tool Windows-build-tools (npm module for installing C++ Build Tools). Versions below 1.0.0 download resources over HTTP, which enables MITM interception of the downloaded executables. An attacker on the network could swap the requested resources with m...

Man In The Middle (MitM)

windows-build-tools is vulnerable to man-in-the-middle MitM attacks due to downloading installer packages over insecure http protocol. It may cause remote code execution RCE by swapping out the requested package with an attacker controlled package if the attacker is on the network or positioned i...

Downloads Resources over HTTP

Overview Affected versions of windows-build-tools insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...

Apache Archiva 1.3.4 Cross Site Request Forgery

Hi, This is regarding multiple CSRF Cross Site Request Forgery Vulnerabilities in Apache Archiva 1.3.4 and previous versions. The following is the disclosure document Title: Multiple CSRF Vulnerabilities in Apache Archiva 1.3.4 --------------------------------------------------------------------...