Mac Users Targeted by Spyware Spreading via Xcode Projects

A campaign aimed at Mac users is spreading the XCSSET suite of malware, which has the capability to hijack the Safari web browser and inject various JavaScript payloads that can steal passwords, financial data and personal information, deploy ransomware and more. Infections are propagating via...

PT-2020-13677 · Vmware · Harbor

Name of the Vulnerable Software and Affected Versions: Harbor versions prior to 2.0.1 Description: The issue allows for a limited Server-Side Request Forgery SSRF attack. An attacker with the ability to edit projects can scan ports of hosts accessible on the Harbor server's intranet...

How CARTA Strategies for Web Applications are Met with Indusface AppTrana Solution

Gartner’s CARTA Continuous Adaptive Risk and Trust Assessment, which sets out their vision for security, is increasingly being adopted by several enterprises. Recently Gartner also called out CARTA strategic approach in the top 10 security projects for 2019. CARTA, being a strategic approach,...

IDOR Disclosure of Private Project Titles - CVE-2020-14174

Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References IDOR vulnerability in the Administration Permission Helper. Affected versions: version 7.13.16 8.0.0 ≤ version 8.5.7 8.6.0 ≤ version 8.9.2...

app.pickmaven:businessdays (>=1.0.0 <=1.0.1), br.com.martinlabs:martinlabs-commons (=3.4) +834 more potentially affected by CVE-2018-10237 via com.google.guava:guava-jdk5 (>=13.0 <=17.0)

com.google.guava:guava-jdk5 MAVEN version =13.0, =1.0.0, =0.1, =0.1, =4.0.2, =1.0, =1.0, =1.0.16, =1.0.16, =2.4.1 and more Source cves: CVE-2018-10237 Source advisory: OSV:GHSA-MVR2-9PJ6-7W5J...

Unspecified Vulnerability in GitLab (CNVD-2020-63394 )

GitLab is a Ruby on Rails-developed, self-hosted, Git version control system project repository application from the American company GitLab. The program can be used to access a project's file contents, commit history, bug lists, and more. A security vulnerability exists in GitLab Enterprise and...

CVE-2020-13270

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...

Design/Logic Flaw

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...

CVE-2020-13270

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...

UBUNTU-CVE-2020-13270

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...

CVE-2020-13270

Missing permission check on fork relation creation in GitLab CE/EE 11.3 and later through 13.0.1 allows guest users to create a fork relation on restricted public projects via API...

CVE-2020-13270

Removed by vendor...

Bridging the Cloud Communication Gap. #LetsTalkCloud

The conversation between you and your Board of Directors is not always a walk in the park. With more and more cloud projects coming your way, it’s time to change the conversation to speak their language and start smoothing out the journey...

PT-2020-13411 · Gitlab · Gitlab Ce/Ee +1

Name of the Vulnerable Software and Affected Versions: GitLab CE/EE versions 11.3 through 13.0.1 Description: A missing permission check on fork relation creation in GitLab CE/EE allows guest users to create a fork relation on restricted public projects via the API. Recommendations: For GitLab...

Vulnerability Spotlight: Multiple vulnerabilities in Siemens LOGO! PLC

Alexander Perez-Palma of Cisco Talos and Emanuel Almeida of Cisco Systems discovered these vulnerabilities. Blog by Jon Munshaw. Cisco researchers recently discovered several vulnerabilities in the Siemens LOGO! PLC. The LOGO! allows users to control various automation projects, such as industria...

June 2, 2020, update for Office 2016 (KB4484335)

None None...

Server side request forgery (ssrf)

Lexiglot through 2014-11-20 allows SSRF via the admin.php?page=projects svnurl parameter...

CVE-2014-8945

CVE-2014-8945 affects Lexiglot, a PHP-based translation platform. The vulnerability is a command injection in admin.php?page=projects, exploitable through the username and password fields. Multiple sources confirm the issue, noting it affects Lexiglot releases up to and including 2014-11-20. The ...

Python and Go Top the Chart of 2019’s Most Popular Hacking Tools

Imperva Cloud WAF protects over a hundred thousand websites globally and observes around a billion of attacks daily. We detect thousands of hacking tools on a daily basis and employ various measures to stop malicious requests. Here are the most dangerous tools and attacks we discover while...

GitLab: Possibilty to purchase Ultimate - 1 Year (EDU or OSS)

Hi, Any user can purchase Ultimate - 1 Year EDU or OSS which is for educational institutions or open source projects.I have found here https://gitlab.com/gitlab-org/customers-gitlab-com/-/issues/860 list of Gitlab plan id and found Ultimate - 1 Year which is free and purchased. Steps to reproduce...