1069 matches found
Information Disclosure
kernel is vulnerable to information disclosure, A local user with CAPNETADMIN can attach an ebpf filter to setsockopt syscall. This filter can be triggered under the right conditions to leak kernel internal information and allows an attacker to determine the layout of information in kernel memory...
Optimizing For Performance, One Hire at a Time: Part 3
Having previously decided we need to make a new hire onto our team, part 1 of this series examined how to meet the needs of our team going into the future, instead of just adding surface visible technical skills...
Design/Logic Flaw
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service due to an invalid cookie value that could prevent future logins. IBM X-Force ID: 196078...
CVE-2021-20404
IBM Security Verify Information Queue 1.0.6 and 1.0.7 could allow a user on the network to cause a denial of service due to an invalid cookie value that could prevent future logins. IBM X-Force ID: 196078...
Working Together with Our Customers to Build a Sustainable Future
By now, we hope you've read Monday's and Tuesday's blog posts announcing the release of our annual sustainability report, our sustainability program, and the technical innovation behind it...
Rust 安全漏洞
Rust, a general-purpose, compiled programming language from the Mozilla Foundation, is vulnerable until version 1.0.4. The vulnerability stems from the program ButtplugFutureStateShared not properly considering objects, which leads to data contention. No details of the vulnerability are currently...
Security Bulletin: Multiple vulnerabilities in IBM Java Runtime affect Rational Synergy (CVE-2016-3426)
Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Technology Edition, Version 6 Service Refresh 16 Fix Pack 20 that is used by IBM Rational Synergy. These issues were disclosed as part of the IBM Java SDK updates in April 2016. Vulnerability Details CVEID: CVE-2016-3426...
Patch Tuesday, Good Riddance 2020 Edition
Microsoft today issued its final batch of security updates for Windows PCs in 2020, ending the year with a relatively light patch load. Nine of the 58 security vulnerabilities addressed this month earned Microsofts most-dire "critical" label, meaning they can be abused by malware or miscreants to...
RUSTSEC-2020-0118 Future<T> lacks bounds on Send and Sync.
tinyfuture contains a light-weight implementation of Futures. The Future type it has lacked bound on its Send and Sync traits. This allows for a bug where non-thread safe types such as Cell can be used in Futures and cause data races in concurrent programs. The flaw was corrected in commit c79191...
Future<T> lacks bounds on Send and Sync.
tinyfuture contains a light-weight implementation of Futures. The Future type it has lacked bound on its Send and Sync traits. This allows for a bug where non-thread safe types such as Cell can be used in Futures and cause data races in concurrent programs. The flaw was corrected in commit c79191...
PT-2020-17617
Name of the Vulnerable Software and Affected Versions tiny future versions prior to 0.4.0 Description The issue is related to the tiny future crate, which contains a light-weight implementation of Futures. The Future type lacks bounds on its Send and Sync traits, allowing non-thread safe types su...
Reverse Engineering Tools: Evaluating the True Cost
When sourcing software for business needs, what criteria should you follow? Price typically tops the list. And sure, free software, like the Linux OS, delivers cost savings, stability, flexibility and ongoing development. No argument there. But when it comes to decompilers, which are used for...
Cross-site Scripting Vulnerability in Cloud Creative Future Innovation and Entrepreneurship Credit Management System
The Innovation and Entrepreneurship Credit Management System is the complete credit information collection, conversion credit management system. A cross-site scripting vulnerability exists in the Cloud Creative Future Innovation and Entrepreneurship Credit Management System. An attacker can use...
The Future of Cloud Security
Effectively securing the cloud is a long-term commitment, as the state of cybercrime and vulnerabilities are constantly evolving. Risk reduction comes from knowing how to secure the cloud now and into the future...
SIRAS - Security Incident Response Automated Simulations
Security Incident Response Automated Simulations SIRAS are internal/controlled actions that provide a structured opportunity to practice the incident response plan and procedures during a realistic scenarios. the main idea of SIRAS is create an detection-as-a-code testing scenarios to facilitate...
GitLab EE Denial of Service Vulnerability (CNVD-2020-66584)
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A denial o...
GitLab 安全漏洞
GitLab is an open source application developed using Ruby on Rails that implements a self-hosted Git project repository that can be accessed through a web interface for public and private projects.GitLab EE is the GitLab Enterprise Edition and GitLab CE is the GitLab Community Edition. A denial o...
Corporate Office and Kitchen Table: Securing the Future of Work, Part 1
The future of work is multi-modal, the future corporate office is a private coffee shop with great Wi-Fi, and the future of enterprise security is going to have to adapt rapidly. If there is a sliver of positivity that I can find in this devastating pandemic, it's that we are adapting and finding...
Jenkins controller environment variables accessible in kubernetes
kubernetes 1.27.3 and earlier includes a feature to replace placeholders in pod template and container template fields with environment variable values. This feature allows low-privilege users to access possibly sensitive Jenkins controller environment variables. kubernetes 1.27.4 disables this...
