Microsoft Security Update Validation Report April 2022

Microsoft’s April 2022 security updates have passed Citrix testing the updates are listed below. The testing is not all-inclusive; all tests are executed against English only environments and issues may still be found upon implementation. Follow best practices for testing and installing software...

7 Rapid Questions: Meet Adrian Stewart, Aspiring Pilot Turned Product Manager

Welcome back to 7 Rapid Questions, our blog series where we ask passionate leaders at Rapid7 how they’re challenging convention and making an impact. In this installment, we talk to Adrian Stewart, a product manager working on InsightAppSec, Rapid7’s dynamic application security testing DAST tool...

The vulnerability of component 2D of the Oracle GraalVM Enterprise Edition, which allows a hacker to trigger a service failure

The vulnerability of the 2D component of the Oracle GraalVM Enterprise Edition exists due to insufficient testing of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

The vulnerability of the ImageIO component in the Oracle GraalVM Enterprise Edition virtual machine allows a hacker to trigger a service failure.

The vulnerability of the ImageIO component in the Oracle GraalVM Enterprise Edition virtual machine exists due to insufficient testing of input data. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

CVE-2020-27376

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication...

CVE-2020-27375

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Transmitting Write Requests and Chars...

Authentication flaw

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication...

CVE-2020-27374

CVE-2020-27374 affects Dr Trust USA iCheck Connect BP Monitor BP Testing 118 (firmware 1.2.1). The available connected documents describe a replay-attack vulnerability against the BP monitoring function. Concrete technical details beyond the vulnerability label (e.g., root cause, affected subsyst...

CVE-2020-27375

CVE-2020-27375 affects the Dr Trust USA iCheck Connect BP Monitor BP Testing 118, version 1.2.1. The vulnerability is described as exposure to Transmitting Write Requests and Chars. The connected sources do not provide root cause details or a confirmed exploit, and no remediation/fix is specified...

CVE-2020-27376

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 version 1.2.1 is vulnerable to Missing Authentication...

CVE-2020-27376

The connected sources identify CVE-2020-27376 as an access-control vulnerability in Dr Trust USA iCheck Connect BP Monitor BP Testing 118, version 1.2.1, described as Missing Authentication. Affected product and version are stated; CVSS indicates HIGH severity (AVG 8.3–8.8 depending on metric set...

Dr Trust USA iCheck Connect BP Monitor BP Testing 118存在未明漏洞

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 is a digital blood pressure monitor and tester from Dr Trust. A security vulnerability exists in Dr Trust USA iCheck Connect BP Monitor BP Testing 118 1.2.1, which stems from vulnerability to replay attacks against BP Monitoring. No detailed...

Dr Trust USA iCheck Connect BP Monitor BP Testing 118代码问题漏洞

Dr Trust USA iCheck Connect BP Monitor BP Testing 118 is a digital blood pressure monitor and tester from Dr Trust. Dr Trust USA iCheck Connect BP Monitor BP Testing 118 is vulnerable to a code issue, no details of the vulnerability are available at this time. Details of the vulnerability are not...

Improve Your Hacking Skills with 9 Python Courses for Just $39

For anyone with interest in cybersecurity, learning Python is a must. The language is used extensively in white hat hacking, and professionals use Python scripts to automate tests. It also has a use in the "soft" side of cybersecurity — like scraping the web for compromised data and detecting bug...

neotropical.pensoft.net Cross Site Scripting vulnerability OBB-2454030

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Using payable.transfer functions in WithdrawFacet.sol and Libasset.sol is not usable for smart contract calls due to possible shortage of gas.

Lines of code Vulnerability details Impact Withdrawals and transferERC20 tokens are executed via transferERC20 and withdraw functions. Since these functions calls with a fixed amount of gas, it's not yet guaranteed to reach to the destination if the receiver is a smart contract. Proof of Concept...

Risk of centralization

Lines of code Vulnerability details Medium Risk Risk of centralization Impact Diamond owner has too many roles on setting the functions, initiating payable functions. If the Owner account is compromised, the assets may be drained in this trustless system. Proof of Concept Tools Used Static testin...

Cloud Pentesting, Pt. 2: Testing Across Different Deployments

In part one of this series, we broke down the various types of cloud deployments. So, pentesting in the cloud is just like on-prem, right? Who asks these loaded questions!? The answer is yes and no. It depends on how a customer has set up their cloud deployment. Let’s cover a few basics first,...

PT-2022-18842 · Jenkins · Jenkins Proxmox Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins Proxmox Plugin version 0.7.0 and earlier Description: A cross-site request forgery CSRF issue allows attackers to connect to a specified host using a specified username and password, disable SSL/TLS validation for the entire Jenkins...

VulnCheck KEV: CVE-2019-7483

In SonicWall SMA100, an unauthenticated Directory Traversal vulnerability in the handleWAFRedirect CGI allows the user to test for the presence of a file on the server...