Supercharge your C++ analysis with SonarLint for CLion

Earlier this year we launched the support for C and C++ in SonarLint for CLion to address quality and security issues for your C/C++ projects. Since then, the team has continued to bring even greater value to the C and C++ users, continuing our mission to empower the community to deliver code tha...

How Does DMARC Prevent Phishing?

DMARC is a global standard for email authentication. It allows senders to verify that the email really comes from whom it claims to come from. This helps curb spam and phishing attacks, which are among the most prevalent cybercrimes of today. Gmail, Yahoo, and many other large email providers hav...

Security Bulletin: Rational Asset Analyzer is affected by a WebSphere Application Server vulnerability.

Summary WebSphere Application Server Liberty used by Rational Asset Analyzer is vulnerable to an XML External Entity Injection XXE vulnerability. This has been addressed. Vulnerability Details CVEID: CVE-2021-20492 DESCRIPTION: IBM WebSphere Application Server 8.0, 8.5, 9.0, and Liberty Java Batc...

The vulnerability of the lys_node_free() function in the syntax analyzer and modeling tool of the YANG Libyang language, related to the insufficient use of the assert() function, allows attackers to trigger a service failure.

The vulnerability of the lysnodefree function in the syntax analyzer and modeling tool of the YANG Libyang language is related to the insufficient use of the assert function. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability of the call() function in the src/parser.c component of the control flow analyzer for C source files, related to the use of memory after its release, allows a attacker to trigger a service failure.

The vulnerability of the call function in the src/parser.c component of the control flow analyzer for C source files is related to the use of memory after it is freed. Exploiting this vulnerability could allow an attacker to cause a service failure...

EulerOS 2.0 SP2 : wireshark (EulerOS-SA-2021-2438)

According to the versions of the wireshark packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Wireshark is a network traffic analyzer for Unix-ish operating systems.This package lays base for libpcap, a packet capture and filtering...

zeek -- several vulnerabilities

Tim Wojtulewicz of Corelight reports: Paths from log stream make it into system unchecked, potentially leading to commands being run on the system unintentionally. This requires either bad scripting or a malicious package to be installed, and is considered low severity. Fix potential unbounded...

ckb-analyzer (>=0.37.0 <=0.39.2), ckb-app-config (>=0.37.0 <=0.100.0-rc2) +60 more potentially affected by CVE-2021-45697 via molecule (>=0.2.5 <=0.7.1)

molecule CARGO version =0.2.5, =0.37.0, =0.37.0, =0.4.0, =0.37.0, =0.37.0, =0.37.0, =0.40.0, =0.40.0, =0.37.0, =0.37.0, =0.37.0, =0.37.0, =0.1.0, =0.37.0, =0.39.1 and more Source cves: CVE-2021-45697 Source advisory: OSV:GHSA-82HM-VH7G-HRH9...

PackageDNA - Tool To Analyze Software Packages Of Different Programming Languages That Are Being Or Will Be Used In Their Codes

This tool gives developers, researchers and companies the ability to analyze software packages of different programming languages that are being or will be used in their codes, providing information that allows them to know in advance if this library complies with processes. secure development, i...

[Gov.sol] Ignoring the return value of function _token.approve(...)

Handle eriksal1217 Vulnerability details Impact Medium Risk vulnerability - This does not immediately affect the contract, tokens, or funds associated but could have negative effects in regards to how the contract behaves when executing this functionality. Proof of Concept According to Slither...

Unchecked transfers found in 3 contracts

Handle maplesyrup Vulnerability details Impact This is a high priority vulnerability because it definitely affects the way that funds are transferred and sent between the contracts. You want to make sure that you check the boolean value from these transfer functions in order to make sure that the...

PT-2021-6277 · Fortinet · Fortimanager +1

Name of the Vulnerable Software and Affected Versions: FortiManager versions prior to 7.0.1 FortiAnalyzer versions prior to 7.0.1 Description: A Use After Free vulnerability in the fgfmsd daemon may allow a remote, non-authenticated attacker to execute unauthorized code as root via sending a...

Wireshark: Multiple vulnerabilities

Background Wireshark is a network protocol analyzer formerly known as ethereal. Description Multiple vulnerabilities have been discovered in Wireshark. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaround There...

Security Bulletin: IBM InfoSphere Information Analyzer is vulnerable to cross-site scripting.

Summary A cross-site scripting vulnerability in IBM InfoSphere Information Analyzer was addressed. Vulnerability Details CVEID: CVE-2021-29712 DESCRIPTION: IBM InfoSphere Information Server is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code i...

IBM InfoSphere Information Server 跨站脚本漏洞

IBM InfoSphere Information Server is a set of data integration platforms from IBM in the United States. The platform can be used to integrate data information obtained from various sources. A cross-site scripting vulnerability exists in IBM InfoSphere Information Analyzer that allows a user to...

Plixer Scrutinizer NetFlow & sFlow Analyzer SQL注入漏洞

Plixer Scrutinizer is a network traffic analysis system that collects, analyzes, visualizes, and reports data from every network conversation and digital transaction to provide security and network intelligence. A SQL injection vulnerability exists in Plixer Scrutinizer version 19.0.2. An attacke...

Cognitive Content Analyzer < 2.3 - Unauthorised AJAX call via CSRF

The plugin did not properly check for CSRF in its blobinatoranalyze AJAX action, allowing attacker to make a logged in administrator call the blobinatorprocesstext method with arbitrary parameters and update the related post with the results. POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Accep...

Security Bulletin: Rational Asset Analyzer (RAA) is affected by a WebSphere Application Server vulnerability (CVE-2021-26296)

Summary Rational Asset Analyzer RAA has addressed the following vulnerability: CVE-2021-26296 Vulnerability Details CVEID: CVE-2021-26296 DESCRIPTION: Apache MyFaces is vulnerable to cross-site request forgery, caused by improper validation of user-supplied input. By persuading an authenticated...

Security Bulletin: Rational Asset Analyzer is affected by a vulnerability in WebSphere Application Server Liberty (CVE-2020-5258)

Summary Rational Asset Analyzer team has addressed the following vulnerability: CVE-2020-5258. Vulnerability Details CVEID: CVE-2020-5258 DESCRIPTION: Dojo dojo could allow a remote attacker to inject arbitrary code on the system, caused by a prototype pollution flaw. By injecting other values, a...

Zoho ManageEngine Eventlog Analyzer Path Traversal Vulnerability

ZOHO ManageEngine EventLog Analyzer is a system and event log analysis software from ZOHO. A path traversal vulnerability exists in Zoho ManageEngine Eventlog Analyzer 12147 and earlier versions, which is caused by an unauthenticated directory traversal through a ZIP archive entry. An attacker...