1652 matches found
[SECURITY] Fedora 35 Update: asnip-0-0.6.20200618git44ba98b.fc35
Asnip retrieves all IPs used by an organization for surface mapping. It uses the IP or domain name and looks up the Autonomous System Number ASN, retrieves the Classless Inter-Domain Routing CIDR subnet masks and converts them to IPs...
Attack Surface Discovery
Binary data domaindiscovery.nbin...
Design/Logic Flaw
The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead o...
CVE-2022-32290
The client in Northern.tech Mender 3.2.0, 3.2.1, and 3.2.2 has Incorrect Access Control. It listens on a random, unprivileged TCP port and exposes an HTTP proxy to facilitate API calls from additional client components running on the device. However, it listens on all network interfaces instead o...
Application Security in 2022: Where Are We Now?
It’s always a good thing to take a step back every once in a while to take the lay of the land. Like you, we are always working at a breakneck pace to help secure the web applications being built today and ready ourselves to secure the innovations of the future. When Forrester put out The State o...
API Security: Best Practices for a Changing Attack Surface
API usage is skyrocketing. According to the latest State of the API Report, API requests increased by 56% last year to a total of 855 million, and Google says the growth isn’t expected to slow any time soon. APIs – short for application programming interfaces – are a critical component of how...
What Are Shadow IDs, and How Are They Crucial in 2022?
Just before last Christmas, in a first-of-a-kind case, JPMorgan was fined $200M for employees using non-sanctioned applications for communicating about financial strategy. No mention of insider trading, naked shorting, or any malevolence. Just employees circumventing regulation using, well, Shado...
How Threat Exposure Management Can Minimize Attack Surface
...
Malicious Basket Could Be Used To Rug Fractionalized Token Holders
Lines of code Vulnerability details Proof-of-Concept The NibblVaultFactory.createVault accepts any NFT address or any Basket address. Therefore, an attacker could pass a malicious basket address during vault creation. function createVault address assetAddress, address curator, string memory name,...
Trend Micro CEO Discusses Need for a Unified Cybersecurity Platform
In the face of evolving cyberattacks, an ever-expanding digital attack surface, and a global skills shortage, organizations need a more unified approach to managing cyber risk. Trend Micro co-founder & CEO Eva Chen discusses our vision and strategy for delivering a unified cybersecurity platform...
June 23, 2022—KB5014668 (OS Build 22000.778) Preview
None None...
Malicious code in flat-surface-shader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b79619ad01b41b1f647e4d1d03d5d0de5fa184d9232c5628b2585cc8786bbaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3070 Malicious code in flat-surface-shader (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b79619ad01b41b1f647e4d1d03d5d0de5fa184d9232c5628b2585cc8786bbaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2020-36549 GE Voluson S8 Windows Operating System Patches privileges management
A vulnerability classified as critical was found in GE Voluson S8. Affected is the underlying Windows XP operating system. Missing patches might introduce an excessive attack surface. Access to the local network is required for this attack to succeed...
Addressing Cyber Risk with a Unified Platform
Hear from guest speaker, Forrester analyst, Allie Mellen, as she shares insights and advice on the factors firms should consider when looking at leveraging a security platform for managing the attack surface lifecycle...
CVE-2022-2037
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0...
CVE-2022-2037
Excessive Attack Surface in GitHub repository tooljet/tooljet prior to v1.16.0...
CVE-2022-2037
CVE-2022-2037 affects ToolJet (tooljet/tooljet) before v1.16.0. The vulnerability is described as an Excessive Attack Surface. Severity varies by source (NVD CVSS2/3.1 reports base scores up to 8.0/9.8 in CNA data). A fix exists in v1.16.0 and later; upgrade to 1.16.0+ to mitigate. Technical deta...