Vulnerability disclosure in aviation

We joined Boeing and United Airlines on a panel recently at the RSA Conference to talk about vulnerability disclosure in the aviation world. The engagement we are now seeing between researchers and industry is a powerful force for positive change. Hopefully this will start to reduce the number of...

test-submitting edit 24

Lines of code L1 Vulnerability details Testing to see if I can edit a finding I don't own Assessed type Access Control --- The text was updated successfully, but these errors were encountered: All reactions...

Design/Logic Flaw

MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for this issue...

CVE-2023-38494

CVE-2023-38494 affects MeterSphere Cloud interfaces; root cause is interfaces lacking configuration permissions, enabling sensitive data disclosure. Public details indicate versions prior to 2.10.4 LTS are affected; 2.10.4 LTS contains the patch. Remediation: upgrade to 2.10.4 LTS (or apply vendo...

CLSA-2023-1691083401 Fix CVE(s): CVE-2022-3697

SECURITY UPDATE: improper handling of towercallback parameter in amazon.aws collection - debian/patches/CVE-2022-3697.patch: ec2instance - validate options on towercallback - CVE-2022-3697 Enable unit testing...

A Penetration Testing Buyer's Guide for IT Security Teams

The frequency and complexity of cyber threats are constantly evolving. At the same time, organizations are now collecting sensitive data that, if compromised, could result in severe financial and reputational damage. According to Cybersecurity Ventures, the cost of cybercrime is predicted to hit ...

MTE As Implemented, Part 1: Implementation Testing

By Mark Brand, Project Zero Background In 2018, in the v8.5a version of the ARM architecture, ARM proposed a hardware implementation of tagged memory, referred to as MTE Memory Tagging Extensions. Through mid-2022 and early 2023, Project Zero had access to pre-production hardware implementing thi...

CVE-2023-31425 - Privilege escalation via the fosexec command

A vulnerability in the fosexec command of Brocade Fabric OS after Brocade Fabric OS v9.1.0 and, before Brocade Fabric OS v9.1.1 could allow a local authenticated user to perform privilege escalation to root by breaking the rbash shell. Starting with Fabric OS v9.1.0, “root” account access is...

Due to revert found during testing it would be wise to implement a rollback and re-whitelist should it be needed

Lines of code Vulnerability details Impact During testing with the Mainnet fork for the migration testing. We needed to make a distinction between V1 Profiles and V2 profiles within the test code, but this is not so in the standard V2 code, and may cause unforeseen issues after the upgrade. The V...

Exploit for CVE-2023-38646

🛡️ Exploit for CVE-2023-38646 🛡️ Welcome to this powerful exp...

The vulnerabilities of microprogramming software in Honeywell Experion PKS programmable logic controllers, Honeywell Experion LX measurement and control controllers, and the Experion PlantCruise distribution control system allow attackers to compromise the confidentiality, integrity, and accessibility of protected information.

The vulnerabilities of microprogrammed software in Honeywell Experion PKS programmable logic controllers, Experion LX measurement and control controllers, and Experion PlantCruise distribution systems are related to insufficient testing of value return. Exploitation of these vulnerabilities could...

Preventing Web Application Access Control Abuse

SUMMARY The Australian Signals Directorate’s Australian Cyber Security Centre ACSC, U.S. Cybersecurity and Infrastructure Security Agency CISA, and U.S. National Security Agency NSA are releasing this joint Cybersecurity Advisory to warn vendors, designers, and developers of web applications and...

TESTING CHANGE SEVERITY

Lines of code L1 Vulnerability details TESTING REFACTOR Assessed type Context --- The text was updated successfully, but these errors were encountered: All reactions...

Malicious code in some_internal_package_for_testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 53107273160f2452143bcbee916077e6adbca0f10d5f2d80e0afeb276d92d788 The OpenSSF Package Analysis project identified 'someinternalpackagefortesting' @ 99.9.9 npm as malicious. It is considered malicious because: -...

CakeFuzzer - Automatically And Continuously Discover Vulnerabilities In Web Applications Created Based On Specific Frameworks

Cake Fuzzer is a project that is meant to help automatically and continuously discover vulnerabilities in web applications created based on specific frameworks with very limited false positives. Currently it is implemented to support the Cake PHP framework. If you would like to learn more about t...

The vulnerability of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition and Oracle GraalVM for JDK virtual machine allows a perpetrator to gain access to read, modify, add, or delete data.

The vulnerability of the Oracle Java SE software platform and the Oracle GraalVM Enterprise Edition and Oracle GraalVM for JDK virtual machines is related to insufficient testing of input data. Exploiting this vulnerability can allow an attacker operating remotely to gain read, modify, add, or...

Oracle Application Testing Suite (Jul 2023 CPU)

The version of Oracle Application Testing Suite installed on the remote host is affected by multiple vulnerabilities as referenced in the July 2023 CPU advisory: - Vulnerability in the Oracle Application Testing Suite product of Oracle Enterprise Manager component: Load Testing for Web Apps Apach...

CVE-2023-37362

Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website...

CVE-2023-37362 Weintek Weincloud Improper Authentication

Weintek Weincloud v0.13.6 could allow an attacker to abuse the registration functionality to login with testing credentials to the official website...

CVE-2023-37362

CVE-2023-37362 affects Weintek Weincloud v0.13.6. The issue is an improper authentication via the registration function that could allow an attacker to log in with testing credentials on the official site. Reported scores indicate high impact (NVD CVSSv3.1: 8.8; ICS-CERT: 7.2). Mitigation: Weinte...