Escalating China-Taiwan Tensions Fuel Alarming Surge in Cyber Attacks

The rising geopolitical tensions between China and Taiwan in recent months have sparked a noticeable uptick in cyber attacks on the East Asian island country. "From malicious emails and URLs to malware, the strain between China's claim of Taiwan as part of its territory and Taiwan's maintained...

Spring Tips: Vaadin Flow and Spring Boot 3

Hi, Spring fans! In this installment, we'll look at the fantastic Vaadin Flow library, which has recently been updated for Spring Boot 3, and how it can help you be happier. the code is available, as usual, here this episode features special guest Marcus Hellberg, VP developer relations from...

SUSE CVE-2014-5273

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.0.x before 4.0.10.2, 4.1.x before 4.1.14.3, and 4.2.x before 4.2.7.1 allow remote authenticated users to inject arbitrary web script or HTML via the 1 browse table page, related to js/sql.js; 2 ENUM editor page, related to...

PT-2023-10623 · Unknown · Ridhoq Soundslike

Name of the Vulnerable Software and Affected Versions: ridhoq soundslike affected versions not specified Description: A critical issue was found in ridhoq soundslike, affecting the get song relations function of the file app/api/songs.py. This issue leads to sql injection. Recommendations: Apply ...

CVE-2022-44012

An issue was discovered in /DS/LMAPI/api/SelectionService/InsertQueryWithActiveRelationsReturnId in Simmeth Lieferantenmanager before 5.6. An attacker can execute JavaScript code in the browser of the victim if a site is loaded. The victim's encrypted password can be stolen and most likely be...

Authorization Bypass

github.com/openfga/openfga is vulnerable to authorization bypass. The vulnerability is due to a lack of an error if a wildcard is encountered in the ttu evaluation when the wildcard is defined in the authorization model's tuple set relations...

GHSA-F4MM-2R69-MG5F OpenFGA Authorization Bypass

Overview During our internal security assessment, it was discovered that OpenFGA versions v0.2.3 and prior are vulnerable to authorization bypass under certain conditions. Am I Affected? You are affected by this vulnerability if you are using openfga/openfga version v0.2.3 or prior, and your mode...

CVE-2022-39341

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue...

CVE-2022-39341 OpenFGA Authorization Bypass

OpenFGA is an authorization/permission engine. Versions prior to version 0.2.4 are vulnerable to authorization bypass under certain conditions. Users who have wildcard defined on tupleset relations in their authorization model are vulnerable. Version 0.2.4 contains a patch for this issue...

PT-2022-24911 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions prior to 0.2.4 Description: OpenFGA is an authorization/permission engine. The issue allows for authorization bypass under certain conditions, specifically when users have a wildcard defined on tupleset relations in their...

PT-2022-24912 · Openfga · Openfga

Name of the Vulnerable Software and Affected Versions: OpenFGA versions prior to 0.2.4 Description: OpenFGA is an authorization/permission engine. The issue concerns authorization bypass under certain conditions, specifically when a relation is defined as a tupleset involving anything other than ...

A Bootiful Podcast: Couchbase and Cloud legend Laurent Doguin

Hi, Spring fans! In this installment, Josh Long @starbuxman talks to his friend, fellow Java Champion, and director of developer relations and strategy at Couchbase, Laurent Doguin @ldoguin SpringOne 2022 is almost here! This is our first in-person event since the pandemic and its when we release...

[SECURITY] Fedora 35 Update: golang-github-burntsushi-toml-test-0.2.0-11.20210108git9767d20.fc35

Toml-test is a higher-order program that tests other TOML decoders or encoder s. The goal is to make it comprehensive. Tests are divided into two groups: inva lid TOML data and valid TOML data. Decoders that reject invalid TOML data pass invalid TOML tests. Decoders that accept valid TOML data an...

[Security Nation] Pete Cooper and Irene Pontisso on the Results of the UK Government’s Security Culture Challenge

!\Security Nation\ Pete Cooper and Irene Pontisso on the Results of the UK Government’s Security Culture Challengehttps://blog.rapid7.com/content/images/2022/07/securitynationlogo.jpg In this episode of Security Nation, Jen and Tod are joined again by Pete Cooper and Irene Pontisso of the UK...

Malicious code in com.innogames.asset-relations-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 006155dfec2bcd3c7418901d1aa90178944c9f42ec9d831a897e50844b265e81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2039 Malicious code in com.innogames.asset-relations-viewer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 006155dfec2bcd3c7418901d1aa90178944c9f42ec9d831a897e50844b265e81 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2040 Malicious code in com.innogames.asset-relations-viewer-addressables (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 81ae03950b09c854e3888fb0f69bec9fab0b81bd98f06e7c522bff8dda778b03 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

GitLab: New /add_contacts /remove_contacts quick commands susseptible to XSS from Customer Contact firstname/lastname fields

Summary In Gitlab 15.0.0 a new Customer Relations feature was added that allows us to use quick actions to find the contact we wish to select. However, I noticed that if I set the contact's first name or last name to alertdocument.domain we can get the XSS to trigger when we are attempting to use...

Meet Mike Elissen: Founder of Our Akamai Developer Champions Program

Our longest-standing Developer Advocate, Mike Elissen, noticed an opportunity to make Akamai’s developer relations even stronger. He co-created Developer Champions, an advocacy program that helps Akamai employees better meet customer needs...

CVE-2021-34654

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...