Extended-SSRF-Search - Smart SSRF Scanner Using Different Methods Like Parameter Brute Forcing In Post And Get...

This tool search for SSRF using predefined settings in different parts of a request path, host, headers, post and get parameters. First step Rename example.app-settings.conf to app-settings.conf and adjust settings. The most important setting is the callback url. I recommend to use burp...

The Game Changing Role of Performance Testing (Part 1)

In two previous blogs, VMware Carbon Black software engineers discussed how important it was to maintain a balance of latency, scale, and cost as they built out and enhanced the company’s reputation services. They also provided some insights into the challenges they encountered with various...

How we productized our staging environment and survived to tell the tale

Managing the Imperva SaaS infrastructure is like herding cats. There are so many moving parts, new developments, testing, fixing bugs, patching, reducing our SLAs, fighting the bad guys and, most importantly, pushing our latest and greatest to production every week. And it all runs like clockwork...

go-toolset:ol8 security update

go-toolset 1.12.12-1 - Update for golang package fixes 1.12.12-1 - Bump version to 1.12.12 golang 1.12.12-4.0.1 - from upstream https://github.com/golang/go/issues/2775 - move arbitrary value 10% to 15% for GC tests, hits 10.48% on our - infrastructure - Resolves failing post build tests Orabug:...

Fedora 31 : nodejs-yarn (2020-766ce5adae)

Update to 1.21.1 - Provides /usr/bin/yarn - Resolves CVE-2019-10773 - Rename nodejs-yarn binary package to yarnpkg similar to other distros - Use nodejs macros consistently throughout spec - Make the tests fail the build if the tests fail Note that Tenable Network Security has extracted the...

SUSE-SU-2020:0311-1 Security update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client

This update for crowbar-core, crowbar-openstack, openstack-neutron-fwaas, rubygem-crowbar-client contains the following fixes: Security fixes for rubygem-crowbar-client: - CVE-2018-17954: Fixed an issue where crowbar was leaking the secret admin passwords to all nodes bsc1117080 Changes in...

Aircrack-ng 1.6 - Complete Suite Of Tools To Assess WiFi Network Security

Aircrack-ng is a complete suite of tools to assess WiFi network security. It focuses on different areas of WiFi security: Monitoring: Packet capture and export of data to text files for further processing by third party tools. Attacking: Replay attacks, deauthentication, fake access points and...

Corsy v1.0 - CORS Misconfiguration Scanner

Corsy is a lightweight program that scans for all known misconfigurations in CORS implementations. Requirements Corsy only works with Python 3 and has the following depencies: tld requests To install these dependencies, navigate to Corsy directory and execute pip3 install -r requirements.txt Usag...

Evaluating Your Security Controls? Be Sure to Ask the Right Questions

Testing security controls is the only way to know if they are truly defending your organization. With many different testing frameworks and tools to choose from, you have lots of options. But what do you specifically want to know? And how are the findings relevant to the threat landscape you face...

openSUSE Security Update : libgcrypt (openSUSE-2020-22)

This update for libgcrypt fixes the following issues : Security issues fixed : - CVE-2019-13627: Mitigation against an ECDSA timing attack bsc1148987. Bug fixes : - Added CMAC AES self test bsc1155339. - Added CMAC TDES self test missing bsc1155338. - Fix test dsa-rfc6979 in FIPS mode. This updat...

SUSE SLED15 / SLES15 Security Update : libgcrypt (SUSE-SU-2019:3392-1)

This update for libgcrypt fixes the following issues : Security issues fixed : CVE-2019-13627: Mitigation against an ECDSA timing attack bsc1148987. Bug fixes: Added CMAC AES self test bsc1155339. Added CMAC TDES self test missing bsc1155338. Fix test dsa-rfc6979 in FIPS mode. Note that Tenable...

CVE-2014-4536: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in tests/notAutotestContactServicepauseCampaign.php in the Infusionsoft Gravity Forms plugin before 1.5.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 go, 2 contactId, or 3 campaignId parameter...

CVE-2019-16559

A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system...

CVE-2019-16559

A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system...

Cross site request forgery (csrf)

A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system...

CVE-2019-16560

A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system...

CVE-2019-16559

A missing permission check in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers with Overall/Read permission to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system...

CVE-2019-16560: Cross-Site Request Forgery (CSRF)

A cross-site request forgery vulnerability in Jenkins WebSphere Deployer Plugin 1.6.1 and earlier allows attackers to perform connection tests and determine whether files with an attacker-specified path exist on the Jenkins master file system...

Managing Traffic From the Outset - How GTM Can Make Your Deployments Easier

What is GTM Global Traffic Management, or GTM, is a DNS-based load balancing service that offers application owners a level of flexibility and insight that is unmatched by traditional on-prem solutions. Highly scalable and fault-resilient, GTM offers customers a layer of abstraction between...

The vulnerability of the ABAP Tests module of the SAP NetWeaver Process Integration software allows a perpetrator to execute operating system commands with elevated privileges.

The vulnerability of the ABAP Tests module of the SAP NetWeaver Process Integration software exists due to the lack of measures taken to neutralize special elements used in the operating system command set. Exploiting this vulnerability allows a malicious actor to execute operating system command...