1326 matches found
PT-2021-14645 · Jenkins · Jenkins
Name of the Vulnerable Software and Affected Versions: Jenkins versions 2.274 and earlier, LTS versions 2.263.1 and earlier Description: The issue allows attackers to read arbitrary files using the file browser for workspaces and archived artifacts by following symlinks. This is possible because...
CVE-2020-29491
creationtimestamp| type| source ---|---|--- 2020-12-21 17:59:56+00:00| seen| https://t.me/thehackernews/949 2020-12-22 13:47:00+00:00| seen| https://t.me/informationsecuritychannel/42441 2020-12-22 16:34:26+00:00| seen| https://t.me/YemenShield/684 2020-12-23 11:54:13+00:00| seen|...
EDR in block mode stops IcedID cold
We are happy to announce the general availability of endpoint detection and response EDR in block mode in Microsoft Defender for Endpoint. EDR in block mode turns EDR detections into real-time blocking of malicious behaviors, malware, and artifacts. It uses Microsoft Defender for Endpoint’s...
EDR in block mode stops IcedID cold
We are happy to announce the general availability of endpoint detection and response EDR in block mode in Microsoft Defender for Endpoint. EDR in block mode turns EDR detections into real-time blocking of malicious behaviors, malware, and artifacts. It uses Microsoft Defender for Endpoint’s...
Open-Xchange: Some build dependencies are downloaded over an insecure channel (without subsequent integrity checks)
The script phase of pdns's .travis.yml file runs a script named ./build-scripts/travis.sh. The main path of execution of this script downloads two dependencies libsodiumdev and libsodium13 via wget over an insecure channel i.e. using http rather than https. Further evidence of this can be found i...
Chinese APT Hackers Target Southeast Asian Government Institutions
Cybersecurity researchers today unveiled a complex and targeted espionage attack on potential government sector victims in South East Asia that they believe was carried out by a sophisticated Chinese APT group at least since 2018. "The attack has a complex and complete arsenal of droppers,...
CVE-2020-27629
In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts...
CVE-2020-27629
In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artifacts...
CVE-2020-27629
Affected product: JetBrains TeamCity (before 2020.1.5). Vulnerability: secure dependency parameters could be left unmasked in dependency builds when there are no internal artifacts. Root cause: failure to mask sensitive dependency parameters under certain build conditions. Impact: potential expos...
JetBrains TeamCity 安全漏洞
JetBrains TeamCity is a set of distributed build management and continuous integration tools from the Czech company JetBrains. The tool provides continuous unit testing, code quality analysis and build problem analysis reports and other features. A security vulnerability exists in JetBrains...
Windows File Enumeration Intel Gathering Tool 2.2
from subprocess import Popen, PIPE import sys,argparse,re MIT License Copyright c 2020 John Page aka hyp3rlinx Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files the "Software", to deal in the Software without...
Velociraptor - Endpoint Visibility and Collection Tool
Velociraptor is a tool for collecting host based state information using Velocidex Query Language VQL queries. To learn more about Velociraptor, read the documentation on: https://www.velocidex.com/docs/ Quick start If you want to see what Velociraptor is all about simply: 1. Download the binary...
New web skimmer steals credit card data, sends to crooks via Telegram
The digital credit card skimming landscape keeps evolving, often borrowing techniques used by other malware authors in order to avoid detection. As defenders, we look for any kind of artifacts and malicious infrastructure that we might be able to identify to protect our users and alert affected...
Ripple20 Critical Vulnerabilities – Detection Logic and Signatures
ARCHIVED STORY Ripple20 Critical Vulnerabilities – Detection Logic and Signatures By Steve Povolny · August 05, 2020 This document has been prepared by McAfee Advanced Threat Research in collaboration with JSOF who discovered and responsibly disclosed the vulnerabilities. It is intended to serve ...
pwntools
It is an offensive tool for binary exploitation. The repository contains the pwntools project, a Python library for binary exploitation. The primary vulnerability class targeted by this tool is RCE Remote Code Execution. The probable entry points for this tool are the exploit.py script and the...
Design/Logic Flaw
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...
CVE-2020-2214
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...
CVE-2020-2214
Jenkins ZAP Pipeline Plugin 1.9 and earlier programmatically disables Content-Security-Policy protection for user-generated content in workspaces, archived artifacts, etc. that Jenkins offers for download...
PT-2020-15429 · Jenkins · Jenkins +1
Name of the Vulnerable Software and Affected Versions: Jenkins ZAP Pipeline Plugin versions 1.9 and earlier Jenkins versions prior to 2.228 excluding 2.227 and older, 2.204.5 and older, due to different security concerns Jenkins versions 2.228 through 2.230 Jenkins 2.222.x LTS versions Jenkins...
Snapchat: Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.io
Researcher found valid jFrog credentials which were committed to a public Github repository of a Snap employee. This allowed access to internal Snap libraries/artifacts along with the ability to push updates to existing artifacts as well...