Colonial Pipeline’s Ransomware Attack Sparks Emergency Declaration

The Biden administration has declared a state of emergency that covers 17 states and Washington D.C. in the wake of the ransomware attack on the Colonial Pipeline Co., and is working with Colonial to restart operations. On Monday morning, FireEye also confirmed to Threatpost that it’s been called...

Ransomware attack shuts down Colonial Pipeline fuel supply

UPDATE 10:47 AM Pacific Time, May 10: At 8:55 AM Pacific Time, the FBI confirmed that Colonial Pipeline was attacked by Darkside. According to a statement posted on Twitter, the FBI said: "The FBI confirms that the Darkside ransomware is responsible for the compromise of Colonial Pipeline network...

Major ransomware attack cripples largest gas pipeline in the US

By Habiba Rashid A massive ransomware attack on one of the largest gas pipelines in the US, Colonial Pipeline, led it to be shut down on Friday. This is a post from HackRead.com Read the original post: Major ransomware attack cripples largest gas pipeline in the US...

Ransomware Cyber Attack Forced the Largest U.S. Fuel Pipeline to Shut Down

Colonial Pipeline, which carries 45% of the fuel consumed on the U.S. East Coast, on Saturday said it halted operations due to a ransomware attack, once again demonstrating how critical infrastructure is vulnerable to cyber attacks. "On May 7, the Colonial Pipeline Company learned it was the vict...

The Colonial Pipeline Hack Is a New Extreme for Ransomware

An attack has crippled the company’s operations—and cut off a large portion of the East Coast’s fuel supply—in an ominous development for critical infrastructure...

Major U.S. Pipeline Crippled in Ransomware Attack

A ransomware attack has halted pipeline activities for the Colonial Pipeline Co., which supplies the East Coast with roughly 45 percent of its liquid fuels. In a statement released on Saturday, Colonial Pipeline said it has temporarily halted pipeline operations in response to a cyberattack...

DevSecOps: How to Systematize Security into the Dev Pipeline

Security within an organization cannot be siloed or left up for DevOps teams to figure out and manage. Learn how applying DevSecOps best practices will have a noticeable positive impact on the security of your overall applications...

Jenkins Templating Engine Plugin Remote Code Execution Vulnerability

Jenkins is a Jenkins open source application . An open source automation server Jenkins provides hundreds of plug-ins to support building, deploying and automating any project . Jenkins Templating Engine Plugin in version 2.1 and earlier versions of a security vulnerability , the vulnerability...

CVE-2021-21646

Jenkins Templating Engine Plugin 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin, allowing attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM...

PT-2021-14689 · Jenkins · Script Security Plugin +2

Name of the Vulnerable Software and Affected Versions: Jenkins Templating Engine Plugin versions 2.1 and earlier Description: The issue allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. This is due to the lack of protection for...

Remote code execution vulnerability in templating-engine

templating-engine 2.1 and earlier does not protect its pipeline configurations using Script Security Plugin. This vulnerability allows attackers with Job/Configure permission to execute arbitrary code in the context of the Jenkins controller JVM. templating-engine 2.2 integrates with Script...

gdal:lvbag_fuzzer: Heap-buffer-overflow in pj_vlog

Project: https://github.com/OSGeo/gdal.git Detailed Report: https://oss-fuzz.com/testcase?key=4867644315533312 Project: gdal Fuzzing Engine: honggfuzz Fuzz Target: lvbagfuzzer Job Type: honggfuzzasangdal Platform Id: linux Crash Type: Heap-buffer-overflow WRITE Crash Address: 0x6330001f4ea0 Crash...

CVE-2021-21432

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the /.netrc file. Refer to the referenced GitHub Security...

CVE-2021-21432

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the /.netrc file. Refer to the referenced GitHub Security...

Authentication flaw

Vela is a Pipeline Automation CI/CD framework built on Linux container technology written in Golang. An authentication mechanism added in version 0.7.0 enables some malicious user to obtain secrets utilizing the injected credentials within the /.netrc file. Refer to the referenced GitHub Security...

CVE-2021-21432

The CVE-2021-21432 entry concerns the Vela server (Go-vela/server), where an authentication mechanism added in version 0.7.0 allows a malicious user to obtain secrets from the attacker’s injected credentials in ~/.netrc. Reported across multiple feeds, the vulnerability enables information disclo...

Out-of-bounds

A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for iOS prior to v2.21.32, and WhatsApp Business for iOS prior to v2.21.32 could have allowed an out-of-bounds write...

PT-2021-15650

Name of the Vulnerable Software and Affected Versions: WhatsApp for Android versions prior to 2.21.3 WhatsApp Business for Android versions prior to 2.21.3 WhatsApp for iOS versions prior to 2.21.32 WhatsApp Business for iOS versions prior to 2.21.32 Description: A missing bounds check within the...

CVE-2021-24026: Out-of-bounds Write

A missing bounds check within the audio decoding pipeline for WhatsApp calls in WhatsApp for Android prior to v2.21.3, WhatsApp Business for Android prior to v2.21.3, WhatsApp for iOS prior to v2.21.32, and WhatsApp Business for iOS prior to v2.21.32 could have allowed an out-of-bounds write...

Exploit for CVE-2019-1003000

PoC exploit for CVE-2019-1003000, CVE-2019-1003001, and CVE-2019-1003002, which are related to a vulnerability in Jenkins' Script Security, Pipeline: Groovy, and Pipeline: Declarative plugins. The exploit allows users with Overall/Read permission and Job/Configure and optional Job/Build to bypass...