MSTICPy January 2022 hackathon highlights

During the month of January 2022, the Microsoft Threat Intelligence Center MSTIC ran its inaugural hackathon for the open-source Jupyter and Python Security Tools library, MSTICPy. We asked the security community for their contributions to expand and improve MSTICPy’s features and capabilities, a...

nuclei-templates

This repository is a collection of templates for the nuclei engine, a tool used to find security vulnerabilities in applications. The templates are used to identify potential vulnerabilities and are contributed by both the project's team and the community. The repository contains various template...

Welcome to Akamai TechDocs

We're pleased to announce the launch of Akamai’s brand-new documentation site: techdocs.akamai.com. Powered by ReadMe, our new site offers intuitive and interactive content designed to help you get the most out of your Akamai products...

[SECURITY] Fedora 35 Update: thefuck-3.32-1.fc35

This application corrects your previous console command. If you use BASH, you should add these lines to your .bashrc: alias fuck=3D'eval $thefuck $fc -ln -1; history -r' alias FUCK=3D'fuck' For other shells please check /usr/share/doc/thefuck/README.md...

github-readme-stats cross-site scripting vulnerability

github-readme-stats is an open source project. github-readme-stats suffers from a cross-site scripting vulnerability that stems from the lack of proper validation of client-side data by WEB applications, which can be exploited by attackers to execute client-side code...

nuclei-templates

This is a GitHub repository for a community-driven project called "Nuclei Templates". The project provides a collection of templates for the Nuclei engine to find security vulnerabilities in applications. The repository contains various files and workflows for managing and updating the templates,...

Cross-Site Scripting vulnerability in @backstage/plugin-auth-backend

Impact This vulnerability allows a malicious actor to trick another user into visiting a vulnerable URL that executes an XSS attack. This attack can potentially allow the attacker to exfiltrate access tokens or other secrets from the user's browser. The default CSP does prevent this attack, but i...

Path Traversal in @backstage/plugin-scaffolder-backend

Impact A malicious actor with write access to a registered scaffolder template is able to manipulate the template in a way that writes files to arbitrary paths on the scaffolder-backend host instance. This vulnerability can in some situation also be exploited through user input when executing a...

vulhub1

This is a repository for a project called Vulhub, which appears to be a collection of vulnerable systems and applications for testing and learning purposes. The repository contains various files and directories, including: 1. .gitattributes: A file that specifies which files should be ignored by...

[SECURITY] Fedora 35 Update: wordpress-5.8.2-1.fc35

Wordpress is an online publishing / weblog package that makes it very easy, almost trivial, to get information out to people on the web. Important information in /usr/share/doc/wordpress/README.fedora...

nuclei-templates

This repository is an offensive tool for nuclei templates, which are used to find security vulnerabilities in applications. The primary CVE ID present in the context is not explicitly mentioned, but the repository contains a workflow for CVE annotation. The target product/service or framework is...

[SECURITY] Fedora 34 Update: wordpress-5.8.1-1.fc34

Wordpress is an online publishing / weblog package that makes it very easy, almost trivial, to get information out to people on the web. Important information in /usr/share/doc/wordpress/README.fedora...

vulhub

This repository is an offensive tool for vulnerability research and exploitation. It contains a collection of vulnerable environments and exploits for various software and frameworks, including Docker, Git, and Oracle Java. The repository is maintained by phith0n and is licensed under the MIT...

vulhub

This repository is an offensive tool for vulnerability research and exploitation. It contains a collection of vulnerable environments and exploits for various software and frameworks, including CouchDB, FFmpeg, Git, and others. The repository is maintained by Vulhub, a community-driven project fo...

charlotte

This is a C++ shellcode launcher, fully undetected as of May 13th, 2021. It dynamically invokes Win32 API functions, XOR encrypts shellcode and function names, and uses random XOR keys and variables per run. The code is designed to be stealthy and difficult to detect. The code is written in C++ a...

Security Bulletin: A security vulnerability has been identified in WebSphere Application Server shipped with IBM Intelligent Operations Center (CVE-2021-29754)

Summary IBM WebSphere® Application Server is shipped with IBM® Intelligent Operations Center. Information about a security vulnerability affecting IBM WebSphere Application Server has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the...

Script injection

Impact A malicious internal actor is able to upload documentation content with malicious scripts. These scripts would normally be sanitized by the TechDocs frontend, but by tricking a user to visit the content via the TechDocs API, the content sanitazion will be bypassed. If the TechDocs API is...

Security Bulletin: A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Automation Manager

Summary A security vulnerability in Node.js hosted-git-info module affects IBM Cloud Automation Manager. Vulnerability Details CVEID: CVE-2021-23362 DESCRIPTION: Node.js hosted-git-info module is vulnerable to a denial of service, caused by a regular expression denial of service ReDoS flaw in the...

Security Bulletin: Infosphere BigInsights is affected by a vulnerability in DB2 (CVE-2015-1947).

Summary Infosphere BigInsights is affected by a local escalation of privilege vulnerability in DB2 CVE-2015-1947. The vulnerability exists in the Big SQL server component included in BigInsights. Vulnerability Details CVEID: CVE-2015-1947 DESCRIPTION: IBM DB2 is vulnerable to a privilege escalati...

Security Bulletin: IBM GPFS/Spectrum Scale integrates with Infosphere BigInsights. Information about a security vulnerability affecting GPFS / Spectrum Scale has been published in a security bulletin.

Summary IBM GPFS/Spectrum Scale integrates with Infosphere BigInsights. Information about a security vulnerability affecting GPFS / Spectrum Scale has been published in a security bulletin. Vulnerability Details Please consult the GPFS / Spectrum Scale documentation for vulnerability details and...