Setting secure defaults on AWS and avoiding misconfigurations

Wiz cloud security researcher, Scott Piper, suggests measures organizations can adopt to ensure secure defaults on AWS and improve their security posture...

Malicious code in electron-secure-defaults (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53019875613fda42ff05ef2cbbd5556997c7b2dde7c3a61ea752dfc7cc0719ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-2691 Malicious code in electron-secure-defaults (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53019875613fda42ff05ef2cbbd5556997c7b2dde7c3a61ea752dfc7cc0719ae Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2022-30322

A flaw was found in go-getter. Several vulnerabilities were identified in the way go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service. Mitigation The fix...

CVE-2022-30321

A flaw was found in go-getter. Several vulnerabilities were identified in the way go-getter processes HTTP responses, response headers, and password-protected ZIP files. This flaw allows an attacker to bypass certain configuration settings and may lead to a denial of service. Mitigation The fix...

CVE-2019-3700 yast: Fallback to DES without configuration in /etc/login.def

yast2-security didn't use secure defaults to protect passwords. This became a problem on 2019-10-07 when configuration files that set secure settings were moved to a different location. As of the 20191022 snapshot the insecure default settings were used until yast2-security switched to stronger...

CVE-2019-3700

The CVE-2019-3700 entry relates to yast2-security not using secure defaults for passwords. Technical details across connected records show insecure defaults used prior to version 4.2.6, with password hashes potentially protected poorly due to DES encryption. The fix stated is that yast2-security ...

CVE-2005-3177

CHKDSK in Microsoft Windows 2000 before Update Rollup 1 for SP4, Windows XP, and Windows Server 2003, when running in fix mode, does not properly handle security descriptors if the master file table contains a large number of files or if the descriptors do not satisfy certain NTFS conventions,...