Over a Dozen Malicious NPM Packages Caught Hijacking Discord Servers

At least 17 malware-laced packages have been discovered on the NPM package Registry, adding to a recent barrage of malicious software hosted and delivered through open-source software repositories such as PyPi and RubyGems. DevOps firm JFrog said the libraries, now taken down, were designed to gr...

NicheStack embedded TCP/IP has vulnerabilities

Overview HCC Embedded's software called InterNiche stack NicheStack and NicheLite, which provides TCP/IP networking capability to embedded systems, is impacted by multiple vulnerabilities. The Forescout and JFrog researchers who discovered this set of vulnerabilities have identified these as...

JFrog Artifactory < 6.23.1 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote machine is prior to 6.23.1. It is, therefore, affected by multiple vulnerabilities: - CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to...

JFrog < 6.1 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 6.1. It is, therefore, affected by multiple vulnerabilities: - A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which...

JFrog < 7.8.1 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.8.1. It is, therefore, affected by multiple vulnerabilities: - A deserialization flaw was discovered in the jackson-databind in versions before 2.8.10 and 2.9.1, which could...

JFrog < 6.23.0 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 6.23.0. It is, therefore, affected by multiple vulnerabilities: - The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation. CVE-2017-18640 - The file...

JFrog < 7.7.0 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.7.0. It is, therefore, affected by multiple vulnerabilities: - An h2c direct connection to Apache Tomcat 10.0.0-M1 to 10.0.0-M6, 9.0.0.M5 to 9.0.36 and 8.5.1 to 8.5.56 did no...

JFrog < 7.9.0 File Inclusion Vulnerability

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.9.0. It is affected by the following vulnerability: - A file inclusion vulnerability was found in the AJP connector enabled with a default AJP configuration port of 8009 in...

JFrog Artifactory Installed (Linux)

Binary data jfrogartifactorynixinstalled.nbin...

JFrog Artifactory < 7.10.5 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote machine is prior to 7.10.5. It is, therefore, affected by multiple vulnerabilities: - CiphertextHeader.java in Cryptacular 1.2.3, as used in Apereo CAS and other products, allows attackers to...

JFrog < 7.10.1 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.10.1. It is, therefore, affected by multiple vulnerabilities: - Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may...

JFrog Artifactory < 7.10.2 Authentication Bypass

An authentication bypass vulnerability exists in JFrog Artifactory prior to 7.10.2 due to a vulnerability in google-oauth-client library. An unauthenticated, remote attacker can exploit this, by a using malicious app on the client-side to obtain the authorization code and use it to gain...

JFrog < 7.11.1 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is prior to 7.11.1. It is, therefore, affected by multiple vulnerabilities: - A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This...

JFrog Artifactory Installed (Windows)

Binary data jfrogartifactorywininstalled.nbin...

CVE-2019-17444

Jfrog Artifactory uses default passwords such as "password" for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0...

CVE-2019-17444

Jfrog Artifactory uses default passwords such as "password" for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0...

Default credentials

Jfrog Artifactory uses default passwords such as "password" for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0...

CVE-2019-17444

Jfrog Artifactory prior to 6.17.0 uses default admin passwords (e.g., “password”) and does not require users to change them, enabling network-based attackers to fully compromise the instance. The issue affects Artifactory versions before 6.17.0. Remediation documented in connected sources: upgrad...

CVE-2019-17444 JFrog Artifactory does not enforce default admin password change

Jfrog Artifactory uses default passwords such as "password" for administrative accounts and does not require users to change them. This may allow unauthorized network-based attackers to completely compromise of Jfrog Artifactory. This issue affects Jfrog Artifactory versions prior to 6.17.0...

Snapchat: Leaked JFrog Artifactory username and password exposed on GitHub - https://snapchat.jfrog.io

Researcher found valid jFrog credentials which were committed to a public Github repository of a Snap employee. This allowed access to internal Snap libraries/artifacts along with the ability to push updates to existing artifacts as well...