Malicious code in azure-arm-policyinsights-samples-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4017da4233cfc680669c19e9b2a102228151c27dcb181ff59a7b6ed1ecdd0f7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Introducing Qualys VMDR 2.0

Over the last five years, the number of vulnerabilities disclosed has doubled. The speed at which vulnerabilities are weaponized and leveraged for mass exploitation is down to mere days from weeks. For example, mass exploitation of the Log4Shell vulnerability at the end of 2021 occurred 48 hours...

Security Bulletin: IBM Operations Analytics Predictive Insights is vulnerable to remote code execution (CVE-2021-23450)

Summary IBM Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about WAS Information disclosure vulnerability CVE-2021-23450 which allows a remote user to execute arbitrary code in the browser. This has been addressed and...

Trellix Global Defenders: Follina — Microsoft Office Zero-Day (CVE-2022-30190)

Trellix Global Defenders: Follina — Microsoft Office Zero-Day CVE-2022-30190 By Taylor Mullins, Robin Noyce , Benjamin Marandel · June 3, 2022 Trellix is continuing to monitor the threat activity associated with the Microsoft Office Zero-Day vulnerability that has been dubbed “Follina.”...

MAL-2022-3849 Malicious code in insights-explorer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6352a03d6b7118bd6118e06e5a8aec38658ea60ba7ea57fff1425e26eef97b5d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

new packages: insights-client

An update is available for insights-client. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Google Created 'Open Source Maintenance Crew' to Help Secure Critical Projects

Google on Thursday announced the creation of a new "Open Source Maintenance Crew" to focus on bolstering the security of critical open source projects. Additionally, the tech giant pointed out Open Source Insights as a tool for analyzing packages and their dependency graphs, using it to determine...

The vulnerability of the Microsoft Accessibility Insights browser extension, related to the lack of data protection for service data, allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Microsoft Accessibility Insights browser extension is related to the lack of protection for service data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...

MDR, MEDR, SOCaaS: Which Is Right for You?

Getting the most from managed services Even if a security team was given a blank check to spend whatever they wanted and hire however they wanted, it would still be a massive effort to build a detection and response D&R program tailored to that organization’s specific needs. Thankfully, the...

Cybersecurity Predictions for 2022

Explore Trend Micro Research’s security insights and predictions for 2022 to enable more informed and proactive decision-making...

Security Bulletin: IBM Security Guardium Insights is affected by Node.js vulnerability (CVE-2021-22939)

Summary IBM Security Guardium Insights addressed the following vulnerability. Vulnerability Details CVEID: CVE-2021-22939 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions. If the https API was used incorrectly and "undefined" was in passed for the...

Security Bulletin: IBM Security Guardium Insights is affected by multiple vulnerabilities

Summary IBM Security Guardium Insights addressed the following issues with an update. Vulnerability Details CVEID: CVE-2021-43797 DESCRIPTION: Netty is vulnerable to HTTP request smuggling, caused by improper parsing of the HTTP transfer-encoding request header names. By sending a specially-craft...

CVE-2022-0431

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting...

CVE-2022-0431

Summary (CVE-2022-0431) The vulnerability affects the WordPress Insights from Google PageSpeed plugin prior to version 4.0.4. The issue arises because the plugin does not sanitise and escape several parameters when outputting them in attributes on the settings dashboard, enabling a Reflected Cros...

CVE-2022-0431 Google Pagespeed Insights < 4.0.4 - Reflected Cross-Site Scripting

The Insights from Google PageSpeed WordPress plugin before 4.0.4 does not sanitise and escape various parameters before outputting them back in attributes in the plugin's settings dashboard, leading to Reflected Cross-Site Scripting...

Security Bulletin: Security vulnerability in WebSphere Application Server shipped with Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises (CVE-2021-23450)

Summary IBM WebSphere Application Server is shipped with IBM Predictive Maintenance and Quality and Predictive Maintenance Insights On-Premises. IBM WebSphere Application Server is vulnerable to remote code execution due to Dojo CVE-2021-23450. Vulnerability Details Refer to the security bulletin...

Security Bulletin: IBM Operations Analytics Predictive Insights is vulnerable due to WebSphere Application Server Information Disclosure vulnerability (CVE-2021-29842)

Summary Websphere Application Server WAS is shipped as a component of IBM Operations Analytics Predictive Insights. Information about WAS Information disclosure vulnerability CVE-2021-29842 which allows a remote user to enumerate usernames due to a difference of responses from valid and invalid...

Trellix Global Defenders: LAPSUS$ Data Breaches and Proactive Protections

Trellix Global Defenders: LAPSUS$ Data Breaches and Proactive Protections By Taylor Mullins · March 23, 2022 Trellix is continuing to monitor the threat activity related to the LAPSUS$ threat group and their recent breaches of large organizations such as NVIDIA, Samsung, Microsoft, and Okta. This...

Trellix Global Defenders: LAPSUS$ Data Breaches and Proactive Protections

Trellix Global Defenders: LAPSUS$ Data Breaches and Proactive Protections By Taylor Mullins · March 23, 2022 Trellix is continuing to monitor the threat activity related to the LAPSUS$ threat group and their recent breaches of large organizations such as NVIDIA, Samsung, Microsoft, and Okta. This...

IBM Security Guardium Insights Information Disclosure Vulnerability (CNVD-2022-60422)

IBM Security Guardium Insights is a set of data security solutions from IBM Corporation in the United States. The product supports data analysis, threat alerts, data security auditing and local data monitoring. IBM Security Guardium Insights has an information leakage vulnerability that could be...