Open Doors with Cloud Security Posture Management (CSPM)

Gain insights into the importance of being well-architected during the deployment process and how to quickly remediate risks by shifting best practice checks to the earliest phase of the CI/CD pipeline...

Arbitrary Code Execution

cd-messenger is vulnerable to arbitrary code execution. Untrusted user input to the color argument is passed to the eval function without validation, allowing an attacker to execute arbitrary code...

libvirt security update

5.7.0-15.el7 - qemu: Escape the qemu driver systemd DOT hoax Wim ten Have Orabug: 31380815 5.7.0-14.el7 - vmx: make 'fileName' optional for CD-ROMs Pino Toscano Orabug: 31350200 - vmx: shortcut earlier few 'ignore' cases in virVMXParseDisk Pino Toscano Orabug: 31350200 - domain group: Fix a...

cd-messenger input validation error vulnerability

cd-messenger is a console and file recorder with Gulp automated build tool support by American software developer Mike Erickson. An input validation error vulnerability exists in cd-messenger 2.7.26 and earlier versions, which stems from the 'eval' function executing user input passed to the...

CVE-2020-7675

cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the color argument executed by the eval function resulting in code execution...

Remote code execution

cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the color argument executed by the eval function resulting in code execution...

CVE-2020-7675

cd-messenger through 2.7.26 is vulnerable to Arbitrary Code Execution. User input provided to the color argument executed by the eval function resulting in code execution...

CVE-2020-7675

CVE-2020-7675 affects cd-messenger up to version 2.7.26. The issue is an Arbitrary Code Execution vulnerability caused by unvalidated input passed to the color parameter, which is evaluated via eval. This results in code execution and potential impact on confidentiality, integrity, and availabili...

Security Bulletin: IBM MQ Appliance is affected by Network Security Services (NSS) vulnerabilities (CVE-2019-11729 and CVE-2019-11745)

Summary IBM MQ Appliance has addressed the following Network Security Services vulnerabilities. Vulnerability Details CVEID: CVE-2019-11729 DESCRIPTION: Mozilla Firefox is vulnerable to a denial of service, caused by the improper validation of empty or malformed p256-ECDH public keys before being...

Security Bulletin: IBM MQ Appliance is affected by OpenSSL vulnerabilities (CVE-2019-1547 and CVE-2019-1563)

Summary IBM MQ Appliance has addressed the following OpenSSL vulnerabilities. Vulnerability Details CVEID: CVE-2019-1563 DESCRIPTION: In situations where an attacker receives automated notification of the success or failure of a decryption attempt an attacker, after sending a very large number of...

Arbitrary Code Execution

Overview cd-messenger is a console log logger gulp notification browser node message. Affected versions of this package are vulnerable to Arbitrary Code Execution. User input provided to the color argument executed by the eval function resulting in code execution. PoC var a = require"cd-messenger...

cd-core (>=0.0.3 <=0.0.11) potentially affected by CVE-2020-7675 via cd-messenger (=2.7.12)

cd-messenger NPM version =2.7.12 is affected by a known vulnerability. The following packages have a transitive dependency on cd-messenger and may be impacted: - cd-core =0.0.3, =0.0.11 Source cves: CVE-2020-7675 Source advisory: SNYK:JS-CDMESSENGER-571493...

Node.js third-party modules: [last-commit-log] Command Injection

I would like to report Command Injection in last-commit-log It allows execution of arbitrary commands Module module name: last-commit-log version: [email protected] npm page: https://www.npmjs.com/package/last-commit-log Module Description Node.js module to get the last git commit information...

Integrate Security Into DevOps and IaC

This article provides recommendations on implementing security into your CI/CD and infrastructure as code pipeline, and most importantly, how to enable both security and DevOps to start speaking each other’s languages...

Security Bulletin: IBM MQ is affected by multiple vulnerabilities in IBM Java Runtime

Summary There are multiple vulnerabilities in IBM Runtime Environment Java Version 7 and 8 used by IBM MQ. IBM MQ have addressed the applicable CVEs. These issues were disclosed as part of the IBM Java SDK updates in October 2019. Vulnerability Details CVEID: CVE-2019-2964 DESCRIPTION: An...

Protect Your Container Images and CI/CD Pipeline

Ever wonder if the container images you provide to customers have been checked for vulnerabilities, malware, and other malicious threats? Read this article on how to easily and quickly set up protection for your container images and CI/CD pipeline...

Security Bulletin: IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability (CVE-2019-12406)

Summary IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability Vulnerability Details CVEID: CVE-2019-12406 DESCRIPTION: Apache CXF is vulnerable to a denial of service, caused by the failure to restrict the number of message attachments present in a given...

Security Bulletin: IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability (CVE-2019-4720)

Summary IBM Cloud Private is vulnerable to an IBM WebSphere Application Server Liberty vulnerability Vulnerability Details CVEID: CVE-2019-4720 DESCRIPTION: IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 is vulnerable to a denial of service, caused by sending a specially-crafted request....

Linux: Mount data file partitions, CD/DVD, and USB partitions in noexec mode

Mounting data file partitions in noexec mode can make all files in the partitions nonexecutable, thus preventing security risks. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders...

CVE-2020-4267

CVE-2020-4267 affects IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD. An authenticated user could cause a denial of service via a memory leak in the LDAP authentication path. Affected versions include IBM MQ and MQ Appliance 8.0, 9.1 LTS, and 9.1 CD. Remediation is available: apply IBM fixes FP...