Anatomy of a Cloud-Service Security Update

Our security teams around the world focus on identifying and mitigating security issues as soon as possible while minimizing customer disruption. One of the challenges of a traditional security update is ensuring customers apply the protections promptly. We recently discussed the work that goes...

OSV-2022-644 Global-buffer-overflow in decode_CABAC_bit

OSS-Fuzz report: https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=49538 Crash type: Global-buffer-overflow READ 1 Crash state: decodeCABACbit readcodingunit readcodingquadtree...

GHSA-2QH6-HHVV-M2WW Jenkins HTTP Request Plugin stores HTTP Request passwords unencrypted

HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file jenkins.plugins.httprequest.HttpRequest.xml on the Jenkins controller as part of its configuration when using deprecated Basic/Digest Authentication. These passwords can be viewed by...

WMAgent 安全漏洞

WMAgent is dmwm open source a core workflow management component of the CMS . A security vulnerability exists in WMAgent versions v1.3.3rc2 and 1.3.3rc1, reqmgr 2 versions 1.4.1rc5 and 1.4.0rc2, reqmon version 1.4.1rc5 and global-workqueue version 1.4.1rc5. An attacker can exploit this...

PT-2022-22205

Name of the Vulnerable Software and Affected Versions WMAgent versions 1.3.3rc1 through 1.3.3rc2 reqmgr2 versions 1.4.0rc2 through 1.4.1rc5 reqmon version 1.4.1rc5 global-workqueue version 1.4.1rc5 Description The issue allows attackers to execute arbitrary code via a crafted dbs-client package...

CVE-2022-36901

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-36901

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-36901

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

Design/Logic Flaw

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

CVE-2022-36901

Jenkins HTTP Request Plugin 1.15 and earlier stores HTTP Request passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...

Imperva Reaches New Heights as it Opens PoPs in Cape Town and Rio

Imperva is reaching new heights as we expand our global network of data centers with new points of presence PoPs in Rio de Janeiro, Brazil and Cape Town, South Africa. The two cities, often compared to each other for their many similarities including their breathtaking coastlines, white sandy...

New Ducktail Infostealer Malware Targeting Facebook Business and Ad Accounts

Facebook business and advertising accounts are at the receiving end of an ongoing campaign dubbed Ducktail designed to seize control as part of a financially driven cybercriminal operation. "The threat actor targets individuals and employees that may have access to a Facebook Business account wit...

alsglobal.se Cross Site Scripting vulnerability OBB-2817595

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Jenkins HTTP Request Plugin 安全漏洞

Jenkins and Jenkins Plugin are both Jenkins open source products.Jenkins is a software application . An open source automation server Jenkins provides hundreds of plugins to support building, deploying, and automating any project.Jenkins Plugin is a software application. A security vulnerability...

Imperva Earns Three Cyber Defense Global InfoSec Awards for 2022

The Cyber Defense Awards in conjunction with Cyber Defense Magazine recently announced the winners of their prestigious annual Global Infosec Awards for 2022. We are proud to say that Imperva earned three Global Infosec Awards; as Most Innovative for Application Security, Cutting Edge for Cloud...

Prototype Pollution

react-navigation is vulnerable to prototype pollution. A malicious input can be parsed and decoded as it does not prevent the properties such as "proto" to pollute the global object prototype...

Prototype Pollution

conf-cfg-ini is vulnerable to prototype pollution. A malicious INI file can be parsed and decoded as it does not protect the properties such as "proto" to pollute the global object prototype...

This Week in Spring - July 26th, 2022

Aloha, Spring fans! Im on vacation, reporting to you from the paradise-like island of Maui, Hawaii, and hoping that youre having a wonderful day! My family and I love Hawaii. Its brimming with beauty and serenity, and while the island of Maui, in the state of Hawaii, is very small, the islands ar...

Discover 5 lessons Microsoft has learned about compliance management

Compliance management is a complex process—one that gets increasingly more complicated the larger an organization grows. Microsoft knows this firsthand, not only because of our experience providing Security and Compliance solutions to customers but also because of the global reach and...

Discover 5 lessons Microsoft has learned about compliance management

Compliance management is a complex process—one that gets increasingly more complicated the larger an organization grows. Microsoft knows this firsthand, not only because of our experience providing Security and Compliance solutions to customers but also because of the global reach and...