vulhub

This is a pre-built vulnerable environment based on Docker-Compose, maintained by the Vulhub project. The repository contains a collection of vulnerable applications and services, including CouchDB, FFmpeg, Git, and more, which can be used for testing and training purposes. The environment is...

5 Ways Your Software Supply Chain is Out to Get You, Part 4: Dependency Confusion

Previously, we discussed how three kinds of supply chain attack methods, Vendor Compromise, Exploit Third Party Applications, and Exploit Open Source Libraries are threatening software supply chains, passing risk downstream to the organizations and users that trust and depend on them. In this...

@angular-ru/build-tools (14.46.0), @eui/deps-base (>=10.0.0-beta.1, <=10.3.0-snapshot-1601287379391) potentially affected by CVE-2020-7735 via ng-packagr (>=10.0.0, <=10.1.0)

ng-packagr NPM version =10.0.0, =10.0.0-beta.1, =10.3.0-snapshot-1601287379391 Source cves: CVE-2020-7735 Source advisory: SNYK:JS-NGPACKAGR-1012427...

org.hawkular:hawkular-build-tools (>=12, <=13) potentially affected by CVE-2019-9658 via com.puppycrawl.tools:checkstyle (6.8)

com.puppycrawl.tools:checkstyle MAVEN version 6.8 is affected by a known vulnerability. The following packages have a transitive dependency on com.puppycrawl.tools:checkstyle and may be impacted: - org.hawkular:hawkular-build-tools =12, =13 Source cves: CVE-2019-9658 Source advisory:...

GHSA-9P47-W5XP-F4XR windows-build-tools downloads Resources over HTTP

Affected versions of windows-build-tools insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

windows-build-tools downloads Resources over HTTP

Affected versions of windows-build-tools insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code execution o...

Windows-build-tools Code Execution Vulnerability

windows-build-tools is a tool for building native node compiled modules in Windows. A security vulnerability exists in windows-build-tools versions prior to 1.0.0, which originates when the program downloads an executable file over an unencrypted HTTP connection. A remote attacker can exploit the...

RIPS Integration into Jenkins CI with Pipeline Support

Pipelines The Pipeline approach is a more developer friendly method to define the build and test process of a project. It is as easy as placing a file named Jenkinsfile into your project which contains all the configuration. This is well known from other build tools like Docker or make and improv...

CVE-2017-16003

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

CVE-2017-16003

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

Remote code execution

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

CVE-2017-16003

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

CVE-2017-16003

The CVE-2017-16003 entry affects the Windows tool Windows-build-tools (npm module for installing C++ Build Tools). Versions below 1.0.0 download resources over HTTP, which enables MITM interception of the downloaded executables. An attacker on the network could swap the requested resources with m...

CVE-2017-16003

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

PT-2018-6033

Name of the Vulnerable Software and Affected Versions: windows-build-tools versions prior to 1.0.0 Description: The issue concerns the insecure download of resources over HTTP, making it susceptible to man-in-the-middle MITM attacks. If an attacker is positioned on the network or between the user...

CVE-2017-16003: Missing Encryption of Sensitive Data

windows-build-tools is a module for installing C++ Build Tools for Windows using npm. windows-build-tools versions below 1.0.0 download resources over HTTP, which leaves it vulnerable to MITM attacks. It may be possible to cause remote code execution RCE by swapping out the requested resources wi...

Man In The Middle (MitM)

windows-build-tools is vulnerable to man-in-the-middle MitM attacks due to downloading installer packages over insecure http protocol. It may cause remote code execution RCE by swapping out the requested package with an attacker controlled package if the attacker is on the network or positioned i...

Downloads Resources over HTTP

Overview Affected versions of windows-build-tools insecurely download an executable over an unencrypted HTTP connection. In scenarios where an attacker has a privileged network position, it is possible to intercept the response and replace the executable with a malicious one, resulting in code...

Apache Archiva 1.3.4 Cross Site Request Forgery

Hi, This is regarding multiple CSRF Cross Site Request Forgery Vulnerabilities in Apache Archiva 1.3.4 and previous versions. The following is the disclosure document Title: Multiple CSRF Vulnerabilities in Apache Archiva 1.3.4 --------------------------------------------------------------------...