105 matches found
CVE-2024-38374
A flaw was found in cyclonedx-core-java. It is vulnerable to XML External Entity XXE injection due to an insecure configuration of the DocumentBuilderFactory used to evaluate XPath expressions...
CVE-2024-38374
The CycloneDX core module provides a model representation of the SBOM along with utilities to assist in creating, validating, and parsing SBOMs. Before deserializing CycloneDX Bill of Materials in XML format, cyclonedx-core-java leverages XPath expressions to determine the schema version of the...
CVE-2024-38374
CVE-2024-38374 affects CycloneDX core (cyclonedx-core-java): before deserializing XML BOMs, an insecurely configured DocumentBuilderFactory used in XPath evaluation allowed XXE injection. The issue was fixed in cyclonedx-core-java 9.0.4; later notes indicate the XML Validator path was also affect...
SBOM support in Spring Boot 3.3
Spring Boot 3.3.0 has been released, and it contains support for SBOMs. SBOM stands for "Software Bill of Materials" and describes the components used to build a software artifact. In the context of this blog post, that's your Spring Boot application. These SBOMs are useful because they describe...
CVE-2024-3508
CVE-2024-3508 concerns Bombastic: authenticated users can upload compressed (bzip2 or zstd) SBOMs via the API, with verification that requires decompression of the uploaded file first. The vulnerability centers on the upload endpoint and its handling of compressed content, enabling a partial impa...
Finding the needle in the haystack: effortless SBOM search in your cloud with Wiz
Find out quickly where OS and open-source packages or libraries are deployed in your cloud environments and secure them before potential issues arise...
Exploit for Embedded Malicious Code in Tukaani Xz
CVE-2024-3094 Malicious code was discovered in the upstream ta...
Exploit for Deserialization of Untrusted Data in Alibaba Fastjson
json.org CVE-2022-45688 true & false positive WTF ?? The p...
Exploit for Out-of-bounds Write in Hutool
json.org CVE-2022-45688 false positive The project contains...
Exploit for Out-of-bounds Write in Hutool
json.org CVE-2022-45688 false positive The project contains...
Exploit for Out-of-bounds Write in Hutool
json.org CVE-2022-45688 true positive The project illustrate...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
log4shell false positive This is a simple web project with a...
Exploit for Uncontrolled Resource Consumption in Siemens 6Bk1602-0Aa12-0Tp0_Firmware
log4shell true positive This is a simple web project with a...
Navigate FDA 524b to get your medical cyber device to market
With amendment 524b officially enacted, medical devices across the United States and the globe are living under some new rules and procedures. You’re not alone if you are finding these new regulations a bit complex. Changes to business practices – particularly ones that involve millions of...
CISA Published When to Issue VEX Information
Today, CISA published When to Issue Vulnerability Exploitability eXchange VEX Information, developed by a community of industry and government experts with the goal to offer some guidance and structure for the software security world, including the large and growing global SBOM community. This...
Streamline Software Bill of Materials (SBOM) Generation with Wiz's Agentless SBOM
Enhance software security and supply chain risk management with Wiz's agentless scanning technology for effortless SBOM creation...
GUAC 0.1 Beta: Google's Breakthrough Framework for Secure Software Supply Chains
Google on Wednesday announced the 0.1 Beta version of GUAC short for Graph for Understanding Artifact Composition for organizations to secure their software supply chains. To that end, the search giant is making available the open source framework as an API for developers to integrate their own...
14 Kubernetes and Cloud Security Challenges and How to Solve Them
Recently, Andrew Martin, founder and CEO of ControlPlane, released a report entitled Cloud Native and Kubernetes Security Predictions 2023. These predictions underscore the rapidly evolving landscape of Kubernetes and cloud security, emphasizing the need for organizations to stay informed and ado...
14 Kubernetes and Cloud Security Challenges and How to Solve Them
Recently, Andrew Martin, founder and CEO of ControlPlane, released a report entitled Cloud Native and Kubernetes Security Predictions 2023. These predictions underscore the rapidly evolving landscape of Kubernetes and cloud security, emphasizing the need for organizations to stay informed and ado...
