KumbiaPHP Cross-Site Scripting Vulnerability

KumbiaPHP is a lightweight, BSD-licensed PHP framework. A cross-site scripting vulnerability exists in KumbiaPHP 1.1.1 and earlier versions in development mode. An attacker can exploit this vulnerability via public/pages/kumbia PATHINFO to conduct cross-site scripting attacks...

CVE-2020-14146

KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATHINFO...

CVE-2020-14146

KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATHINFO...

Design/Logic Flaw

KumbiaPHP through 1.1.1, in Development mode, allows XSS via the public/pages/kumbia PATHINFO...

Friday Squid Blogging: Human Cells with Squid-Like Transparency

I think we need more human organs with squid-like features. As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered. Read my blog posting guidelines here...

Meetecho Janus Code Issue Vulnerability

Meetecho Janus is a WebRTC Web Real Time Communication server from Meetecho. A code issue vulnerability exists in Meetecho Janus. The vulnerability stems from an improperly designed or implemented code development process for a web system or product. Detailed vulnerability details are not availab...

Meetecho Janus Code Issue Vulnerability (CNVD-2020-34717)

Meetecho Janus is a WebRTC Web Real Time Communication server from Meetecho. A code issue vulnerability exists in Meetecho Janus. The vulnerability stems from an improperly designed or implemented code development process for a web system or product. Detailed vulnerability details are not availab...

Innovation Driven by Operational Experience and Engineering Insight Deters NXNS Attacks

DNS and security have had a long and tangled relationship. The DNS has always been an attractive target since it's a network leverage point. At DNS OARC 30 in Bangkok in 2019, Akamai's Ralf Weber did a presentation called DNS Security: Past, Present, and Future It's Not Easy covering numerous DNS...

The vulnerability of the DNG file reading and writing software developed by Adobe’s SDK lies in buffer overflow attacks in the dynamic memory, allowing an attacker to execute arbitrary code.

The vulnerability of the DNG file reading and writing software developed by Adobe’s SDK is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

How to Create a Culture of Kick-Ass DevSecOps Engineers

Much like technology itself, the tools, techniques, and optimum processes for developing code evolve quickly. We humans have an insatiable need for more software, more features, more functionality… and we want it faster than ever before, more qualitative, and on top of that: Secure. With an...

[SECURITY] Fedora 32 Update: dpdk-19.11.1-2.fc32

The Data Plane Development Kit is a set of libraries and drivers for fast packet processing in the user space...

Planning Ahead to Prevent Vulnerabilities

The cost to remediate vulnerabilities increases as those vulnerabilities make it further into the development process. If they make it into a final release, those vulnerabilities can leave organizations vulnerable to attacks, costing time and resources to address, as well as causing damage to the...

dpdk: librte_vhost Missing inputs validation in Vhost-crypto

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read...

dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair()

A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index a UInt is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption...

dpdk: librte_vhost Integer overflow in vhost_user_set_log_base()

A vulnerability was found in DPDK versions 18.05 and above. A missing check for an integer overflow in vhostusersetlogbase could result in a smaller memory map than requested, possibly allowing memory corruption...

dpdk: librte_vhost Integer truncation in vhost_user_check_and_alloc_queue_pair()

A memory corruption issue was found in DPDK versions 17.05 and above. This flaw is caused by an integer truncation on the index of a payload. Under certain circumstances, the index a UInt is copied and truncated into a uint16, which can lead to out of bound indexing and possible memory corruption...

dpdk: librte_vhost Missing inputs validation in Vhost-crypto

A vulnerability was found in DPDK versions 18.11 and above. The vhost-crypto library code is missing validations for user-supplied values, potentially allowing an information leak through an out-of-bounds memory read...

Managing Vulnerabilities Introduced from Open Source Code Libraries

Modern development architectures are commonly based around open source components. Using open source components helps organizations lower their overall development cost while improving the time to market for new applications. Introducing these components however, can lead to serious consequences...

Build support for open source in your organization

Have you ever stared at the same lines of code for hours only to have a coworker identify a bug after just a quick glance? That’s the power of community! Open source software development is guided by the philosophy that a diverse community will produce higher quality code by allowing anyone to...

The vulnerability of the Outside In Filters component of the Oracle Software Development Kit (SDK), as well as the Oracle Text component of the Oracle Database Server database management system, allows a malicious individual to gain access to read, delete, and modify data, or to cause a service failure.

The vulnerability of the Outside In Filters component of the Oracle Software Development Kit SDK and the Oracle Text component of the Oracle Database Server system is related to lack of access control mechanisms. Exploiting this vulnerability could allow an attacker to gain read, delete, and modi...