How to Secure DevOps in Microsoft Azure

Want to establish best practices within Microsoft Azure? Learn how to integrate a Secure DevOps Kit for Azure AzSK at the subscription level, as well as in your development process during coding, CI/CD pipeline, and future alerting and reporting...

Open Doors with Cloud Security Posture Management (CSPM)

Gain insights into the importance of being well-architected during the deployment process and how to quickly remediate risks by shifting best practice checks to the earliest phase of the CI/CD pipeline...

Node.js third-party modules: [last-commit-log] Command Injection

I would like to report Command Injection in last-commit-log It allows execution of arbitrary commands Module module name: last-commit-log version: [email protected] npm page: https://www.npmjs.com/package/last-commit-log Module Description Node.js module to get the last git commit information...

Integrate Security Into DevOps and IaC

This article provides recommendations on implementing security into your CI/CD and infrastructure as code pipeline, and most importantly, how to enable both security and DevOps to start speaking each other’s languages...

Protect Your Container Images and CI/CD Pipeline

Ever wonder if the container images you provide to customers have been checked for vulnerabilities, malware, and other malicious threats? Read this article on how to easily and quickly set up protection for your container images and CI/CD pipeline...

GitLab: Stored XSS on the job page

Hello Gitlab! Steps to reproduce: 1. Run Gitlab docker run --detach --hostname gitlab.example.com --publish 443:443 --publish 80:80 --publish 22:22 --name gitlab gitlab/gitlab-ce:latest 2. Create a new project with README.md 3. Go to Operations-Kubernetes 1. Click on the "Add Kubernetes cluster"...

Shift Well-Architecture Left. By Extension, Security Will Follow

A story on how Infrastructure as Code can be your ally on Well-Architecting and securing your Cloud environment By Raphael Bottino, Solutions Architect -- first posted as a medium article Using Infrastructure as CodeIaC for short is the norm in the Cloud. CloudFormation, CDK, Terraform, Serverles...

Akamai Delivers Fast Deployment and Edge Computing for Developers With March 2020 Release

With each iteration, Akamai moves nearer to our goal of enabling elite performance by the development teams that depend on Akamai for delivering reliable and highly performant experiences to their customers. The March 2020 release empowers teams to develop at the Akamai edge with even greater...

What are the benefits of SAST testing in CI/CD pipelines?

Static application security testing SAST is traditionally used in software development lifecycles both early on in the process and often to "white box" test all files containing source code. Integrating SAST into modern CI/CD pipelines allows developers to continuously monitor their code, providi...

Aircrack-ng 1.6 - Complete Suite Of Tools To Assess WiFi Network Security

Aircrack-ng is a complete suite of tools to assess WiFi network security. It focuses on different areas of WiFi security: Monitoring: Packet capture and export of data to text files for further processing by third party tools. Attacking: Replay attacks, deauthentication, fake access points and...

Managing Web Application Security

Web application scanners using dynamic application security testing DAST methods are ideal at identifying common vulnerabilities such as cross-site scripting, SQL injection, command execution and more. When used in conjunction with whitebox static application security testing SAST results that...

Automatic API Attack Tool - Customizable API Attack Tool Takes An API Specification As An Input, Generates And Runs Attacks That Are Based On It As An Output

Imperva's customizable API attack tool takes an API specification as an input, and generates and runs attacks that are based on it as an output. The tool is able to parse an API specification and create fuzzing attack scenarios based on what is defined in the API specification. Each endpoint is...

CVE-2019-15589

An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...

CVE-2019-15589

An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...

Improper access control

An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...

CVE-2019-15589

Removed by vendor...

CVE-2019-15589

GitLab vulnerability CVE-2019-15589 affects GitLab releases prior to 12.3.2, 12.2.6, and 12.1.12. It is described as an improper access control flaw where a blocked user could use GIT clone and pull if they had previously obtained a CI/CD token. The connected sources (OSV, NVD, CNVD, etc.) provid...

CVE-2019-15589

An improper access control vulnerability exists in Gitlab v12.3.2, v12.2.6, v12.1.12 which would allow a blocked user would be able to use GIT clone and pull if he had obtained a CI/CD token before...

CyberRange - The Open-Source AWS Cyber Range

This CyberRange project represents the first open-source Cyber Range blueprint in the world. This project provides a bootstrap framework for a complete offensive, defensive, reverse engineering, & security intelligence tooling in a private research lab using the AWS Cloud. This project contains...

Integrate Security Testing with GitHub Actions

GitHub Actions GitHub announced their own CI/CD system which is integrated into the user interface and called Github Actions. We added RIPS to the GitHub marketplace which enables you to integrate our leading code analysis directly into your GitHub workflow. It works as a security gateway and fai...