Integrating API Security and WAF into K8s Kong API Gateway

Article by Jiju Jacob, Director of Engineering at Revenera This is an update of Mr. Jacobs’ 05/23 post in his Medium blog. He is a Director of Engineering at Revenera. Revenera, born as InstallShield and now a Flexera company, helps software and technology companies use open source solutions more...

TerraformGoat - "Vulnerable By Design" Multi Cloud Deployment Tool

TerraformGoat is selefra research lab's "Vulnerable by Design" multi cloud deployment tool. Currently supported cloud vendors include Alibaba Cloud, Tencent Cloud, Huawei Cloud, Amazon Web Services, Google Cloud Platform, Microsoft Azure. Scenarios ID | Cloud Service Company | Types Of Cloud...

Missing permission checks in Jenkins CloudBees AWS Credentials Plugin allows enumerating credentials IDs

CloudBees AWS Credentials Plugin 1.28 and earlier does not perform a permission check in a helper method for HTTP endpoints. This allows attackers with Overall/Read permission to enumerate credentials IDs of AWS credentials stored in Jenkins if any of the following plugins are installed: - Amazon...

GHSA-FFJ8-W4RJ-VR7V ECS Publisher Plugin stored and displayed API token in plain text

A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration...

ECS Publisher Plugin stored and displayed API token in plain text

A vulnerability in Jenkins ECS Publisher Plugin 1.0.0 and earlier allows attackers with Item/Extended Read permission, or local file system access to the Jenkins home directory to obtain the API token configured in this plugin's configuration...

ecs-sallanches.fr Cross Site Scripting vulnerability OBB-2438582

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

ABC-ECS (>=0.1.4 <=0.2.1), ABC_Game_Engine (>=0.1.0 <=0.1.2) +29852 more potentially affected by CVE-2022-23639 via crossbeam-utils (>=0.1.0 <=0.8.21)

crossbeam-utils CARGO version =0.1.0, =0.1.4, =0.1.0, =0.1.2, =0.1.0, =0.1.0, =0.1.8, =0.1.0, =0.0.0, =0.1.2, =0.1.0, =0.0.8, =0.1.0, =1.0.1 - GuiNistRs =0.1.0 - HPGO =0.9.2 and more Source cves: CVE-2022-23639 Source advisory: OSV:GHSA-QC84-GQF4-9926...

Cryptojacking Attacks Target Alibaba ECS Instances

Discover how some malicious groups disable features in Alibaba Cloud ECS instances for illicit mining of Monero...

Groups Target Alibaba ECS Instances for Cryptojacking

We looked at how some malicious groups disable features in Alibaba Cloud ECS instances for illicit mining of Monero...

@daedalus/angular-handsontable (>=1.0.1 <=1.0.5), @hpcc-js/handson (>=0.0.1 <=0.0.44) +53 more potentially affected by CVE-2021-23446 via handsontable (>=0.25.1 <=0.38.1)

handsontable NPM version =0.25.1, =1.0.1, =0.0.1, =1.0.2, =0.1.0, =0.1.0, =1.0.0-beta1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.1.11, =1.1.12 and more Source cves: CVE-2021-23446 Source advisory: SNYK:JS-HANDSONTABLE-1726770...

ECOA Building Automation System - Directory Traversal Content Disclosure

Exploit Title: ECOA Building Automation System - Directory Traversal Content Disclosure Date: 25.06.2021 Exploit Author: Neurogenesia Vendor Homepage: http://www.ecoa.com.tw ECOA Building Automation System Directory Traversal Content Disclosure Vendor: ECOA Technologies Corp. Product web page:...

ECOA Building Automation System - Path Traversal Arbitrary File Upload

Exploit Title: ECOA Building Automation System - Path Traversal Arbitrary File Upload Date: 25.06.2021 Exploit Author: Neurogenesia Vendor Homepage: http://www.ecoa.com.tw ECOA Building Automation System Path Traversal Arbitrary File Upload Vendor: ECOA Technologies Corp. Product web page:...

ECOA Building Automation System - Weak Default Credentials

Exploit Title: ECOA Building Automation System - Weak Default Credentials Date: 25.06.2021 Exploit Author: Neurogenesia Vendor Homepage: http://www.ecoa.com.tw ECOA Building Automation System Weak Default Credentials Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affecte...

ECOA Building Automation System - Configuration Download Information Disclosure

Exploit Title: ECOA Building Automation System - Configuration Download Information Disclosure Date: 25.06.2021 Exploit Author: Neurogenesia Vendor Homepage: http://www.ecoa.com.tw ECOA Building Automation System Configuration Download Information Disclosure Vendor: ECOA Technologies Corp. Produc...

ECOA Building Automation System Configuration Download Information Disclosure

ECOA Building Automation System Configuration Download Information Disclosure Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected version: ECOA ECS Router Controller - ECS FLASH ECOA RiskBuster Terminator - E6L45 ECOA RiskBuster System - RB 3.0.0 ECOA RiskBuster Syst...

ECOA Building Automation System Hidden Backdoor Accounts Vulnerability

ECOA Building Automation System Hidden Backdoor Accounts and backdoor Function Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected version: ECOA ECS Router Controller - ECS FLASH ECOA RiskBuster Terminator - E6L45 ECOA RiskBuster System - RB 3.0.0 ECOA RiskBuster...

ECOA Building Automation System Missing Encryption

ECOA Building Automation System Missing Encryption Of Sensitive Information Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected version: ECOA ECS Router Controller - ECS FLASH ECOA RiskBuster Terminator - E6L45 ECOA RiskBuster System - RB 3.0.0 ECOA RiskBuster System...

ECOA Building Automation System Arbitrary File Deletion

ECOA Building Automation System Arbitrary File Deletion Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected version: ECOA ECS Router Controller - ECS FLASH ECOA RiskBuster Terminator - E6L45 ECOA RiskBuster System - RB 3.0.0 ECOA RiskBuster System - TRANE 1.0 ECOA...

ECOA Building Automation System Hardcoded SSH Credentials

ECOA Building Automation System Hard-coded Credentials SSH Access Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected version: ECOA ECS Router Controller - ECS FLASH ECOA RiskBuster Terminator - E6L45 ECOA RiskBuster System - RB 3.0.0 ECOA RiskBuster System - TRANE 1...

ECOA Building Automation System Authorization Bypass / Insecure Direct Object Reference

ECOA Building Automation System Authorization Bypass / IDOR Vendor: ECOA Technologies Corp. Product web page: http://www.ecoa.com.tw Affected version: ECOA ECS Router Controller - ECS FLASH ECOA RiskBuster Terminator - E6L45 ECOA RiskBuster System - RB 3.0.0 ECOA RiskBuster System - TRANE 1.0 ECO...